WO2021217477A1 - 异常消息的识别方法和装置 - Google Patents

异常消息的识别方法和装置 Download PDF

Info

Publication number
WO2021217477A1
WO2021217477A1 PCT/CN2020/087711 CN2020087711W WO2021217477A1 WO 2021217477 A1 WO2021217477 A1 WO 2021217477A1 CN 2020087711 W CN2020087711 W CN 2020087711W WO 2021217477 A1 WO2021217477 A1 WO 2021217477A1
Authority
WO
WIPO (PCT)
Prior art keywords
message
difference
value
abnormal
training
Prior art date
Application number
PCT/CN2020/087711
Other languages
English (en)
French (fr)
Inventor
里克罗兰
塞尔丹尼尔
芬茨弗洛里安
魏卓
雅思敏雷哈娜
Original Assignee
华为技术有限公司
德国弗劳恩霍夫应用研究促进协会
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司, 德国弗劳恩霍夫应用研究促进协会 filed Critical 华为技术有限公司
Priority to EP20933299.8A priority Critical patent/EP3979590A4/en
Priority to CN202080005391.XA priority patent/CN112805187B/zh
Priority to PCT/CN2020/087711 priority patent/WO2021217477A1/zh
Publication of WO2021217477A1 publication Critical patent/WO2021217477A1/zh

Links

Images

Classifications

    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B60—VEHICLES IN GENERAL
    • B60R—VEHICLES, VEHICLE FITTINGS, OR VEHICLE PARTS, NOT OTHERWISE PROVIDED FOR
    • B60R16/00—Electric or fluid circuits specially adapted for vehicles and not otherwise provided for; Arrangement of elements of electric or fluid circuits specially adapted for vehicles and not otherwise provided for
    • B60R16/02—Electric or fluid circuits specially adapted for vehicles and not otherwise provided for; Arrangement of elements of electric or fluid circuits specially adapted for vehicles and not otherwise provided for electric constitutive elements
    • B60R16/023—Electric or fluid circuits specially adapted for vehicles and not otherwise provided for; Arrangement of elements of electric or fluid circuits specially adapted for vehicles and not otherwise provided for electric constitutive elements for transmission of signals between vehicle parts or subsystems
    • B60R16/0231—Circuits relating to the driving or the functioning of the vehicle
    • B60R16/0232—Circuits relating to the driving or the functioning of the vehicle for measuring vehicle parameters and indicating critical, abnormal or dangerous conditions
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1425—Traffic logging, e.g. anomaly detection
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F18/00—Pattern recognition
    • G06F18/20—Analysing
    • G06F18/21—Design or setup of recognition systems or techniques; Extraction of features in feature space; Blind source separation
    • G06F18/214—Generating training patterns; Bootstrap methods, e.g. bagging or boosting
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/04—Architecture, e.g. interconnection topology
    • G06N3/045—Combinations of networks
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/08—Learning methods

Definitions

  • This application relates to the field of information technology, and more specifically to an abnormal message recognition method, an abnormal message recognition model training method and device.
  • IDS intrusion detection system
  • ML machine learning
  • the abnormal message recognition model Based on the existing abnormal message recognition scheme, when the abnormal message recognition model is trained, only the difference value of the characteristic value between the two messages (for example, the arrival time interval) is input, and the abnormal message recognition model is based on the abnormal message recognition model. When a message is identified, it is also based on the difference between the two messages. However, in the actual situation, every two messages are not transmitted strictly according to the same difference value, and each two messages may correspond to a variety of difference values. In this way, the above-mentioned abnormal message recognition model obtained by training based on the difference value If it is not accurate enough, the accuracy of identifying abnormal messages based on the abnormal message recognition model will be reduced.
  • the present application provides an abnormal message recognition method, an abnormal message recognition model training method and device, so as to improve the accuracy of the abnormal message recognition model, and further improve the accuracy of the abnormal message recognition model based on the abnormal message recognition model.
  • a method for identifying abnormal messages including: a security execution unit SEU receives a first message, and determines a first difference value between a characteristic value of the first message and a characteristic value of a second message, The second message is a message received before receiving the first message; the SEU determines the difference class corresponding to the first difference value from a plurality of preset difference classes, among the plurality of difference classes Different difference types correspond to different value ranges of difference values; the SEU inputs the identifier of the difference type corresponding to the first difference value into a pre-stored abnormal message identification model to determine whether the first message is an abnormal message or a non-standard message. Exception message.
  • the value range corresponding to the difference value between the characteristic values of the two messages is divided into a plurality of difference classes, and the identification of the difference class corresponding to the first difference value among the plurality of difference classes is input
  • the abnormal message recognition model is used to determine whether the first message is an abnormal message or a non-abnormal message, which avoids that in the prior art, only the difference value (for example, the arrival time interval) between the two messages is input to the abnormal message recognition model , Which is beneficial to improve the accuracy of abnormal message recognition based on the abnormal message recognition model.
  • the above-mentioned second message is a non-abnormal message. It is beneficial to avoid that the feature value of the second message is abnormal because the second message is an abnormal message, thereby affecting the first difference value, and is beneficial to improve the accuracy of abnormal message recognition based on the abnormal message recognition model.
  • the characteristic value is the arrival time of the message
  • the first difference value is the arrival time interval between the arrival time of the first message and the arrival time of the second message.
  • the value range corresponding to the arrival time interval between two messages is divided into multiple difference categories, and the arrival time interval between the first message and the second message in the multiple difference categories
  • the identification of the corresponding difference type is input to the abnormal message recognition model to determine whether the first message is an abnormal message or a non-abnormal message, which is beneficial to improve the accuracy of abnormal message recognition based on the abnormal message recognition model.
  • the method further includes: the SEU determines a second difference value between the characteristic value of the first message and the characteristic value of a third message, and the third message is The non-abnormal message received before the first message; the SEU determines the difference class corresponding to the second difference value from the plurality of difference classes; the SEU determines the difference class corresponding to the first difference value
  • the identification input of the pre-stored abnormal message identification model to determine whether the first message is an abnormal message or a non-abnormal message includes: the SEU identifies the difference category corresponding to the first difference value, and the second difference The identifier of the difference class corresponding to the value is input into the abnormal message identification model to determine whether the first message is an abnormal message or a non-abnormal message.
  • the second difference value between the characteristic value of the first message and the characteristic value of the third message is determined, and the identifier of the difference class corresponding to the second difference value is combined with the difference class corresponding to the first difference value.
  • the identifications of both are in and out of the abnormal message recognition model, which is beneficial to improve the accuracy of abnormal message recognition based on the abnormal message recognition model.
  • the characteristic value is the arrival time of the message
  • the second difference value is the arrival time interval between the arrival time of the first message and the arrival time of the third message.
  • the arrival time interval between the first message and the third message is determined, and the difference type identifier corresponding to the arrival time interval between the first message and the third message is compared with the first message and the first message.
  • the identifiers of the difference classes corresponding to the arrival time interval between the two messages are in and out of the abnormal message recognition model, which is beneficial to improve the accuracy of abnormal message recognition based on the abnormal message recognition model.
  • the different value ranges of the difference values corresponding to the different difference classes in the plurality of difference classes belong to preset multiple value ranges, and the preset multiple value ranges are Based on the natural breakpoint algorithm, the first value range of the feature value is divided, and the upper limit of the first value range is the maximum value corresponding to the feature value in the training data set of the abnormal message recognition model , The lower limit of the first value range is the minimum value corresponding to the characteristic value in the data set.
  • the first value range corresponding to the feature value is divided into the above-mentioned multiple value ranges based on the natural breakpoint algorithm to correspond to different difference categories, which is beneficial to improve the rationality of the division of multiple value ranges .
  • the method further includes: the SEU determines characteristic information of the first message, and the characteristic information of the first message includes each byte in the payload of the first message. Corresponding to the payload data, one or more of the length of the first message or the message identifier of the first message; the SEU inputs the identifier of the difference type corresponding to the first difference value into the pre-stored exception
  • the message recognition model includes: the SEU inputs the identifier of the difference class corresponding to the first difference value and the characteristic information of the first message into the abnormal message recognition model.
  • the identification of the difference category corresponding to the first difference value and the characteristic information of the first message are input into the abnormal message identification model, which is beneficial to improve the accuracy of the abnormal message identification model in identifying abnormal messages. sex.
  • a training method for an abnormal message recognition model including: obtaining a training data set, the training data set including N first training messages, and N first difference values corresponding to the N first training messages
  • the N identifiers of the N difference classes of the N first difference values are the difference values between the characteristic values of the N first training messages and the characteristic values of the corresponding N second training messages
  • the The N first training messages correspond to the N second training messages in a one-to-one relationship
  • the N second training messages are messages that arrive before the corresponding N first training messages reach the target node
  • the N Different difference classes in the two difference classes correspond to different value ranges of difference values, where N is a positive integer greater than 1
  • the pre-stored original abnormal message recognition model is trained to obtain the abnormal message recognition model
  • the abnormal message recognition model is used to determine whether the message to be recognized is an abnormal message or a non-abnormal message.
  • the N identifications of the N difference classes corresponding to the N first difference values of the N first training messages are used as the training data set, and the original abnormal message recognition model is performed based on the training data set.
  • Training avoids the need to train the original abnormal message recognition model directly based on the difference value of the feature value between two messages (for example, the arrival time interval) in the prior art, which is conducive to improving the abnormal message recognition model based on the abnormal message.
  • the accuracy of message recognition is used as the training data set, and the original abnormal message recognition model is performed based on the training data set.
  • the feature value of the aforementioned N first training messages may be the arrival time of the N first training messages at the target node
  • the feature value of the N second training messages may be the arrival time of the N second training messages at the target node.
  • the arrival time, the N first difference values of the above N first training messages may be the arrival time interval between the N first training messages and the N second training messages reaching the target node.
  • the N identifiers of the N difference classes corresponding to the N first difference values of the N first training messages are used as the training data in the training data set, and the original abnormal message is compared based on the training data set.
  • the training of the recognition model avoids that in the prior art, the original abnormal message recognition model is trained directly based on the difference value of the feature value between the two messages (for example, the arrival time interval), which is beneficial to improve the recognition based on the abnormal message.
  • the accuracy of the model's identification of abnormal messages is used as the training data in the training data set, and the original abnormal message is compared based on the training data set.
  • At least some of the foregoing N second training messages are non-abnormal messages. It is beneficial to avoid that the feature value of the second message is abnormal because the second message is an abnormal message, thereby affecting the first difference value, and is beneficial to improve the accuracy of abnormal message recognition based on the abnormal message recognition model.
  • the training data set further includes N identifiers of the N difference classes corresponding to the N second difference values of the N first training messages, and the N second difference values Is the N difference values between the eigenvalues of the N first training messages and the corresponding eigenvalues of the N third training messages, and the N first training messages and the N third training messages are one
  • the N third training messages are messages that arrive before the corresponding first training message reaches the target node, and the N third training messages are non-abnormal messages.
  • the N identifiers of the N difference classes corresponding to the N second difference values of the N first training messages are used as the training data set, where the N third training messages are non-abnormal messages, and Training the original abnormal message recognition model based on the training data set is beneficial to improve the accuracy of abnormal message recognition based on the abnormal message recognition model.
  • the feature value of the aforementioned N first training messages may be the arrival time of the N first training messages at the target node
  • the feature value of the N third training messages may be the arrival time of the N third training messages at the target node
  • the arrival time, the N second difference values of the above N first training messages, may be the arrival time interval between the N first training messages and the N third training messages reaching the target node.
  • the N identifiers of the N difference classes corresponding to the N second difference values of the N first training messages are used as the training data in the training data set, and the original abnormal message is compared based on the training data set.
  • the training of the recognition model avoids that in the prior art, the original abnormal message recognition model is trained directly based on the difference value of the feature value between the two messages (for example, the arrival time interval), which is beneficial to improve the recognition based on the abnormal message.
  • the accuracy of the model's identification of abnormal messages is used as the training data in the training data set, and the original abnormal message is compared based on the training data set.
  • the method before training the pre-stored original abnormal message recognition model based on the training data set to obtain the abnormal message recognition model, the method further includes: determining the characteristic values of the multiple training messages The maximum value of and the minimum value of the characteristic value; determine the value range of the characteristic value according to the maximum value and the minimum value; divide the value range of the characteristic value into a plurality of non-overlapping sub-ranges, Each sub-range corresponds to a first difference category.
  • the value range of the feature value is determined, and the value range of the feature value is divided into non-overlapping ones Multiple sub-ranges, where each sub-range corresponds to a first difference category, that is, a general method for determining multiple difference categories is provided to expand the application scenarios of the embodiments of the present application.
  • an apparatus for identifying abnormal messages includes units for executing the first aspect or any one of the possible implementation manners of the first aspect.
  • an apparatus for identifying abnormal messages includes units for executing the second aspect or any one of the possible implementation manners of the second aspect.
  • a device for identifying abnormal messages has the function of implementing the device in the method design of the first aspect.
  • These functions can be realized by hardware, or by hardware executing corresponding software.
  • the hardware or software includes one or more units corresponding to the above-mentioned functions.
  • a device for identifying abnormal messages has the function of implementing the device in the method design of the second aspect.
  • These functions can be realized by hardware, or by hardware executing corresponding software.
  • the hardware or software includes one or more units corresponding to the above-mentioned functions.
  • a computing device including an input and output interface, a processor, and a memory.
  • the processor is used to control the input and output interface to send and receive signals or information
  • the memory is used to store a computer program
  • the processor is used to call and run the computer program from the memory, so that the computing device executes the method in the above first aspect.
  • a computing device including an input and output interface, a processor, and a memory.
  • the processor is used for controlling the input and output interface to send and receive signals or information
  • the memory is used for storing a computer program
  • the processor is used for calling and running the computer program from the memory, so that the computing device executes the method in the above second aspect.
  • a computer program product includes: computer program code, which when the computer program code runs on a computer, causes the computer to execute the methods in the foregoing aspects.
  • a computer-readable medium stores program code, and when the computer program code runs on a computer, the computer executes the methods in the above-mentioned aspects.
  • a chip system in an eleventh aspect, includes a processor for a computing device to implement the functions involved in the above aspects, such as generating, receiving, sending, or processing the data and data involved in the above methods. /Or information.
  • the chip system further includes a memory, and the memory is used to store the necessary program instructions and data of the terminal device.
  • the chip system can be composed of chips, and can also include chips and other discrete devices.
  • FIG. 1 is a schematic diagram of a system architecture of an abnormal message recognition model application according to an embodiment of the present application.
  • Fig. 2 is a schematic diagram of a hardware device running an abnormal message recognition model according to an embodiment of the present application.
  • FIG. 3 is a functional block diagram of a vehicle 300 to which the embodiment of the present application is applied.
  • Figure 4 shows a schematic diagram of a traditional abnormal message recognition model.
  • FIG. 5 is a schematic flowchart of a method for identifying an abnormal message according to an embodiment of the present application.
  • FIG. 6 is a schematic diagram of the correspondence between the arrival time interval and multiple difference classes in an embodiment of the present application.
  • Fig. 7 is a schematic diagram of an abnormal message identification model according to an embodiment of the present application.
  • Fig. 8 is a flowchart of a method for identifying abnormal messages according to another embodiment of the present application.
  • Fig. 9 is a schematic diagram of an abnormal message identification model according to another embodiment of the present application.
  • FIG. 10 is a schematic diagram of a system architecture 1000 provided by an embodiment of the present application.
  • FIG. 11 is a schematic flowchart of a training method of an abnormal message recognition model according to an embodiment of the present application.
  • FIG. 12 is a schematic flowchart of a method for training an abnormal message recognition model according to another embodiment of the present application.
  • FIG. 13 is a schematic diagram of an abnormal message identification device according to an embodiment of the present application.
  • Fig. 14 is a schematic diagram of a training device for an abnormal message recognition model according to an embodiment of the present application.
  • FIG. 15 is a schematic diagram of a computing device according to another embodiment of the present application.
  • the system 100 shown in FIG. 1 includes an execution device 210, a training device 220, a database 230, a client device 240, a data storage system 250, and a data collection device 260.
  • the data collection device 260 is used to collect the characteristic data of the message and store it in the database 230, and the training device 220 generates the target model/rule 201 (that is, the abnormal message recognition model above) based on the training data maintained in the database 230.
  • the training device 220 obtains the target model/rule 201 based on the training data, so that the target model/rule 201 can identify abnormal messages.
  • the target model/rule obtained by the training device 220 can be applied to different systems or devices.
  • the above-mentioned target model/rule may be applied to a communication network in a ship or a vehicle-mounted network, for example, CAN.
  • the execution device 210 can call data, codes, etc. in the data storage system 250, and can also store data, instructions, etc. in the data storage system 250.
  • the foregoing execution device 210 may include a computing module 211 and an input/output (input/output, I/O) interface 212.
  • the I/O interface 212 is used for data interaction with external devices, and the "user" can input data to the I/O interface 212 through the client device 240.
  • the calculation module 211 uses the target model/rule 201 to process the input message data to be recognized to determine whether the message to be recognized is an abnormal message or a non-abnormal message.
  • the I/O interface 212 returns the processing result to the client device 240 and provides it to the user.
  • the above-mentioned client device 240 may be a display device in a ship to remind the user to identify the abnormal message.
  • the aforementioned client device 240 may also be a display device in a vehicle-mounted device to provide a message that the user recognizes an abnormality.
  • the training device 220 can generate corresponding target models/rules 201 based on different data for different targets, so as to provide users with better results.
  • the user can manually specify the input data in the execution device 210, for example, to operate in the interface provided by the I/O interface 212.
  • the client device 240 can automatically input data to the I/O interface 212 and obtain the result. If the client device 240 automatically inputs data and needs the user's authorization, the user can set the corresponding authority in the client device 240.
  • the user can view the result output by the execution device 210 on the client device 240, and the specific presentation form may be a specific manner such as display, sound, and action.
  • the client device 240 can also serve as a data collection terminal to store the collected feature data of the message in the database 230.
  • FIG. 1 is only a schematic diagram of a system architecture provided by an embodiment of the present invention.
  • the positional relationship between the devices, devices, modules, etc. shown in the figure does not constitute any limitation.
  • the data storage The system 250 is an external memory relative to the execution device 210. In other cases, the data storage system 250 may also place the data storage system 250 in the execution device 210.
  • the following describes a schematic diagram of a hardware device running an abnormal message recognition model according to an embodiment of the present application in conjunction with FIG. 2. It should be noted that the abnormal message detection model in the embodiment of the present application can be implemented by the neural network processor 50 shown in FIG. 2.
  • a neural network processor (neural-network processing unit, NPU) 50 is mounted as a coprocessor to a host central processing unit (Host CPU), and the Host CPU allocates tasks.
  • the core part of the NPU is the arithmetic circuit 503.
  • the controller 504 controls the arithmetic circuit 503 to extract data from the memory (weight memory or input memory) and perform calculations.
  • the arithmetic circuit 503 includes multiple processing units (process engines, PE). In some implementations, the arithmetic circuit 503 is a two-dimensional systolic array. The arithmetic circuit 503 may also be a one-dimensional systolic array or other electronic circuit capable of performing mathematical operations such as multiplication and addition. In some implementations, the arithmetic circuit 503 is a general-purpose matrix processor.
  • the arithmetic circuit fetches the corresponding data of matrix B from the weight memory 502 and caches it on each PE in the arithmetic circuit.
  • the arithmetic circuit fetches the matrix A data and matrix B from the input memory 501 to perform matrix operations, and the partial result or final result of the obtained matrix is stored in an accumulator 508.
  • the vector calculation unit 507 can perform further processing on the output of the arithmetic circuit, such as vector multiplication, vector addition, exponential operation, logarithmic operation, size comparison, and so on.
  • the vector calculation unit 507 can be used for network calculations in the non-convolutional/non-fully connected layers of the neural network, such as pooling, batch normalization, and local response normalization. Wait.
  • the vector calculation unit 507 can store the processed output vector to the unified buffer 506.
  • the vector calculation unit 507 may apply a nonlinear function to the output of the arithmetic circuit 503, such as a vector of accumulated values, to generate the activation value.
  • the vector calculation unit 507 generates a normalized value, a combined value, or both.
  • the processed output vector can be used as an activation input to the arithmetic circuit 503, for example for use in a subsequent layer in a neural network.
  • the unified memory 506 is used to store input data and output data.
  • the direct memory access controller (DMAC) 505 is used to transfer the input data in the external memory to the input memory 501 and/or the unified memory 506, store the weight data in the external memory into the weight memory 502, and store The data in the unified memory 506 is stored in the external memory.
  • DMAC direct memory access controller
  • the bus interface unit (BIU) 51 is used to implement interaction between the main CPU, the DMAC, and the instruction fetch memory 509 through the bus.
  • An instruction fetch buffer 509 connected to the controller 504 is used to store instructions used by the controller 504.
  • the controller 504 is used to call the instructions cached in the memory 509 to control the working process of the computing accelerator.
  • the unified memory 506, the input memory 501, the weight memory 502, and the instruction fetch memory 509 are all on-chip (On-Chip) memories.
  • the external memory is a memory external to the NPU.
  • the external memory can be a double data rate synchronous dynamic random access memory.
  • Memory double data rate synchronous dynamic random access memory, DDR SDRAM), high bandwidth memory (HBM) or other readable and writable memory.
  • the schematic diagram of the general architecture applicable to the embodiment of this application is described above in conjunction with FIG. 1 and FIG.
  • the vehicle 300 described in FIG. 3 can be used as the client device 240 in the system 100.
  • the NPU 50 shown in FIG. 2 may be used as a part of security enforcement units (SEU) in the vehicle 300, or the NPU 50 may act as an SEU to realize the functions corresponding to the SEU.
  • SEU security enforcement units
  • FIG. 3 is a functional block diagram of a vehicle 300 to which the embodiment of the present application is applied.
  • the vehicle 300 shown in FIG. 3 includes an SEU 310, a communication bus 320 of an in-vehicle network, and a functional subsystem 330.
  • the SEU 310 is used to monitor the messages transmitted in the vehicle network, for example, based on the abnormal message identification model, identify the messages transmitted in the vehicle network to determine whether there is an abnormal message in the vehicle network.
  • the above-mentioned SEU 310 can be connected to the communication bus 320 of the in-vehicle network, and can monitor the messages passing through the communication bus 320 to detect the above-mentioned abnormal messages (also referred to as "abnormal messages"). Optionally, it can also perform operations related to the above-mentioned abnormal messages. , For example, issue a warning, etc.
  • the message transmitted in the above vehicle network can be understood as a message transmitted from the first vehicle device to the second vehicle device through the vehicle network, where the first vehicle device and/or the second vehicle device may be in the vehicle
  • the embodiment of the present application does not limit the specific form of the in-vehicle device.
  • the communication bus 320 of the vehicular network can be understood as a communication backbone in the vehicular network, which is used to transmit messages between various nodes of the vehicular network.
  • the above-mentioned message may be in any data format transmitted through the communication bus, for example, may be a single data packet, signal, frame, etc.
  • the embodiments of the present application do not specifically limit this.
  • the communication bus 320 of the above-mentioned vehicle-mounted network may be any type of communication bus of the vehicle-mounted network, which is not limited in the embodiment of the present application.
  • the above vehicle network may be a vehicle network based on a controller area network (CAN).
  • the message transmitted in the vehicle network may be a message based on the CAN protocol.
  • the message may include a CAN ID and a maximum of 8 bytes of payload data.
  • messages that have the same function or sent for the same purpose may have the same identifier or identification (ID), for example, the CAN ID carried in the message specified by the CAN protocol.
  • ID identifier or identification
  • the functional subsystem 330 is used to implement various functions required by the vehicle 300. For example, it may include traveling systems, sensor systems, control systems, and so on.
  • the traveling system may include components that provide power to the vehicle.
  • the travel system may include an engine, an energy source, a transmission, and wheels/tires.
  • the transmission device can transmit the mechanical power from the engine to the wheels.
  • the transmission device may include a gearbox, a differential, and a drive shaft.
  • the transmission device may also include other devices, such as a clutch.
  • the sensor system may include several sensors that sense information about the environment around the vehicle.
  • the sensor system may include a positioning system, an inertial measurement unit (IMU), a radar, a laser rangefinder, and a camera.
  • the sensor system may also include sensors of the internal system of the monitored vehicle (for example, an in-vehicle air quality monitor, a fuel gauge, an oil temperature gauge, etc.). Sensor data from one or more of these sensors can be used to detect objects and their corresponding characteristics (position, shape, direction, speed, etc.). Such detection and identification are key functions for the safe operation of autonomous vehicles.
  • the control system controls the operation of the vehicle and its components.
  • the control system can include various components, including steering system, throttle, braking unit, sensor fusion algorithm, computer vision system, route control system, and obstacle avoidance system.
  • the functional subsystem 330 of the embodiment of the present application may also include other subsystems such as a steering subsystem, which are not listed one by one for the sake of brevity.
  • the abnormal message recognition model Based on the existing abnormal message recognition scheme, when training the abnormal message recognition model, only the first difference value (for example, the arrival time interval) of the feature value between the two messages is input, and the abnormal message recognition model is based on the later When the abnormal message is identified, it is also based on the first difference value between the two messages.
  • the first difference value for example, the arrival time interval
  • every two messages are not transmitted strictly according to the same first difference value, and each two messages may correspond to multiple first difference values.
  • the above-mentioned training based on the first difference value is obtained.
  • the resulting abnormal message recognition model is not accurate enough, and then the accuracy of the abnormal message recognition model based on the abnormal message recognition model will be reduced.
  • FIG. 4 shows a schematic diagram of a traditional abnormal message recognition model.
  • DNN 400 can be understood as a neural network with many hidden layers 120, where "many" does not have a special metric.
  • the multilayer neural network and deep neural network we often say are essentially the same thing.
  • the neural network inside the DNN 400 can be divided into three types: the input layer 410, the hidden layer 420, and the output layer 430.
  • the first layer is the input layer 410
  • the last layer is the output layer 430
  • the number of layers of the middle layer 420 are all hidden layers.
  • the layers are fully connected, that is to say, any neuron in the i-th layer must be connected to any neuron in the i+1th layer.
  • DNN looks complicated, it is not complicated in terms of the work of each layer. Simply put, it is the following linear relationship expression: in, Is the input vector, Is the output vector, b is the offset vector, W is the weight matrix (also called coefficient), and ⁇ () is the activation function.
  • Each layer is just to get the output vector after such a simple operation on the input vector. Due to the large number of DNN layers, the number of coefficients and offset vectors is also large.
  • the superscript l represents the number of layers where the coefficient w is located, and the subscript corresponds to the output l-th layer index j and the input l-th layer index k. Note that the input layer has no parameters. In deep neural networks, more hidden layers make the network more capable of portraying complex situations in the real world. In theory, a model with more parameters is more complex and has a greater "capacity", which means that it can complete more complex learning tasks.
  • the input vector Including the payload data of each bit in the payload of the message to be identified The length I len of the message to be identified, the identifier I ID corresponding to the message to be identified, and the arrival time interval I diff' between the message to be identified and the previous message.
  • the above output vector It can be used to indicate that the message to be identified is an abnormal message or a non-abnormal message.
  • I diff' between the previous message and the previous message is used to determine whether the message to be identified is an abnormal message or a non-abnormal message based on the degree of difference between I diff' and the preset period.
  • the messages with the same ID are not all transmitted according to the same cycle.
  • the messages with the same ID will usually respond to a different cycle. At this time, if it is based on the traditional scheme Recognizing the message to be recognized will limit the accuracy of the abnormal message recognition model.
  • the embodiment of the present application provides a new method for identifying abnormal messages, that is, in the process of identifying messages to be identified (hereinafter also referred to as "first messages") based on the abnormal message recognition model,
  • the recognition model inputs the difference class corresponding to the first difference value between the characteristic value of the first message and the characteristic value of the second message.
  • the value range of the difference value corresponding to the different difference class is different, which is beneficial to improve the abnormal message based
  • the accuracy of the recognition model for abnormal message recognition The following describes the method for identifying abnormal messages in an embodiment of the present application in conjunction with FIG. 5.
  • FIG. 5 is a schematic flowchart of a method for identifying an abnormal message according to an embodiment of the present application.
  • the method 500 shown in FIG. 5 includes step 510 to step 530.
  • the SEU receives the first message, and determines a first difference value between the characteristic value of the first message and the characteristic value of the second message, where the second message is a message received before receiving the first message.
  • the feature value of the first message and the feature value of the second message are used to measure the same attribute of the message, for example, the feature value is the arrival time of the message.
  • the feature value of the first message and the feature value of the second message are used to represent features that have the same effect in the message. For example, it can refer to the value of the payload in the message.
  • the aforementioned characteristic value may refer to the value of the payload in the message.
  • the first difference between the characteristic value of the first message and the characteristic value of the second message can be understood as the payload in the first message.
  • the first difference between the value of and the value of the payload in the second message is used to indicate that the speed of the vehicle is adjusted to the first speed, and the first message may indicate the first speed through the value of the payload in the first message.
  • the second message is used to indicate that the speed of the vehicle is adjusted to the second speed, and the second message may indicate the second speed through the value of the payload in the second message.
  • the aforementioned first difference value is used to indicate the amount of change in the vehicle speed between the first vehicle speed and the second vehicle speed.
  • the aforementioned characteristic value may also indicate the arrival time of the message.
  • the first difference between the characteristic value of the first message and the characteristic value of the second message it can be understood that the arrival time of the first message is different from that of the first message. 2.
  • the time interval between the arrival times of messages also known as the first arrival time interval.
  • the foregoing second message may be the last message of the first message, which can be understood as the second message is the last message received by the SEU before receiving the first message.
  • the first message and the second message may be two adjacent messages.
  • the above-mentioned second message is a non-abnormal message.
  • the second message is an abnormal message or a non-abnormal message.
  • the foregoing second message is a non-abnormal message
  • the second message is the previous message of the first message, that is, the second message is the previous non-abnormal message of the first message.
  • the second message may be a message adjacent to the first message, that is, the previous message of the first message is a non-abnormal message, and the previous message is the second message.
  • the last message of the first message is an abnormal message
  • the second message is the message that is sent before the first message and is closest to the arrival time interval of the first message.
  • whether the above-mentioned second message is an abnormal message may be determined based on the result of identifying the second message by the abnormal message identification model.
  • the SEU determines the difference class corresponding to the first difference value from a plurality of preset difference classes. Different difference classes in the multiple difference classes correspond to different value ranges of the difference value, where the difference value can represent the characteristics of the two messages. The degree of difference between the values.
  • the above-mentioned difference class corresponding to the first difference value can be understood as the difference class corresponding to the value range to which the first difference value belongs.
  • the first difference value is the arrival time interval between the first message and the second message
  • different difference classes in the multiple difference classes correspond to different value ranges of the arrival time intervals.
  • FIG. 6 is a schematic diagram of the correspondence between the arrival time interval and multiple difference classes in an embodiment of the present application.
  • the value range corresponding to the arrival time interval includes [0,t 1 ], (t 1 ,t 2 ], (t 2 ,t x ], (t x ,t max ] And (t max ,t ⁇ ].
  • [t 1 ,t max ] is the value range of the arrival time interval specified by the manufacturer, or the arrival time interval within this range is non-abnormal.
  • (t max ,t ⁇ ] Represents the value range of the arrival time interval outside [t 1 ,t max ], (t max ,t ⁇ ] is the abnormal value range of the arrival time interval.
  • [0,t 1 ] corresponds to the class 1 identification Is 0
  • (t 1 , t 2 ] corresponds to the class 1 identifier is 1
  • (t 2 , t x ] corresponds to the class 1 identifier 2
  • (t x , t max ] corresponds to the class 1 identifier x
  • (T max ,t ⁇ ] corresponding to the class 1 identifier is -1.
  • the SEU inputs the identifier of the difference category corresponding to the first difference value into a pre-stored abnormal message identification model to determine whether the first message is an abnormal message or a non-abnormal message.
  • the aforementioned abnormal message may be understood as a message related to an abnormality, and may include a message sent based on deviation from the expected payload value (content value) or deviation from the expected timing.
  • the above-mentioned abnormal message recognition model based on ML may be a mathematical model based on ML, for example, it may be a DNN or a convolutional neural network, etc.
  • the specific form of the above-mentioned mathematical model in the embodiment of the present application is not limited.
  • the abnormal message recognition model of the embodiment of the present application is introduced with reference to FIG. 7. It should be noted that the model block diagram shown in Figure 7 is similar to the model structure shown in Figure 4, with only improvements to the input layer and input vector. Therefore, for brevity, the model framework with the same functions uses the same Number, and its specific functions will not be repeated below.
  • Fig. 7 is a schematic diagram of an abnormal message identification model according to an embodiment of the present application.
  • the abnormal message recognition model 700 shown in FIG. 7 includes an input layer 710, a hidden layer 420, and an output layer 430.
  • Input vector input to input layer 710 It may include the identifier I diff' of the difference class to which the first difference value belongs, and the value of each bit in the first message The length of the first message I len , the identification of the first message I ID .
  • the solution of the embodiment of the present application is also applicable to this scenario, that is, the first message and the second message have the same message ID.
  • the first message and the second message have the same CAN ID.
  • the message identifiers of the first message and the second message can also be not limited.
  • the characteristic value of the second message will affect the first message to a certain extent.
  • the recognition result of the message in order to avoid this situation and improve the accuracy of identifying abnormal messages, in the embodiment of the present application, the characteristic value of the first message and the value of the previous non-abnormal message (also called the third message) can also be input to the abnormal message recognition model. The degree of difference between eigenvalues.
  • an abnormal message identification method according to another embodiment of the present application will be introduced in conjunction with FIG. 6.
  • Fig. 8 is a flowchart of a method for identifying abnormal messages according to another embodiment of the present application. The method shown in FIG. 8 further includes step 810 to step 830 on the basis of the above method 500.
  • the SEU determines a second difference value between the characteristic value of the first message and the characteristic value of the third message, where the third message is a non-abnormal message received before the first message is received.
  • the meaning of the feature value of the third message is similar to the meaning of the feature value of the second message.
  • the above-mentioned second difference value is the same as the first difference value.
  • the above-mentioned second difference value and the first difference value are also different.
  • the foregoing third message may be the last non-abnormal message of the first message, and it can be understood that the third message is the last non-abnormal message received by the SEU before receiving the first message.
  • the first message and the third message may be two adjacent messages or two non-adjacent messages.
  • the difference category corresponds to the different value ranges of the difference value
  • the difference category corresponding to the second difference value is determined from multiple difference categories, which can be understood as determining the second difference value from the multiple difference categories.
  • the difference class corresponding to the value range is determined from multiple difference categories, which can be understood as determining the second difference value from the multiple difference categories.
  • the above step 530 includes: 830.
  • the SEU inputs the identifier of the difference class corresponding to the first difference value and the identifier of the difference class corresponding to the second difference value into the abnormal message identification model to determine whether the first message is an abnormal message or a non-abnormal message.
  • the identifier of the difference class is used to uniquely identify the corresponding difference class.
  • the identifier of the difference class corresponding to the first difference value is the same as the identifier of the difference class corresponding to the second difference value.
  • the identifier of the difference class corresponding to the first difference value and the identifier of the difference class corresponding to the second difference value may be the same or different.
  • the abnormal message recognition model of the embodiment of the present application is introduced with reference to FIG. 8.
  • the model block diagram shown in Fig. 9 is similar to the model structure shown in Fig. 7 with only improvements to the input layer and input vector. Therefore, for simplicity, the model framework with the same functions uses the same Number, and its specific functions will not be repeated below.
  • Fig. 9 is a schematic diagram of an abnormal message identification model according to another embodiment of the present application.
  • the abnormal message recognition model 900 shown in FIG. 9 includes an input layer 910, a hidden layer 420, and an output layer 430.
  • Input vector input to input layer 910 It may include the identifier I diff' of the difference class corresponding to the first difference value , the identifier I honest-diff' of the difference class corresponding to the second difference value, and the value of each bit in the first message The length of the first message I len , the identification of the first message I ID .
  • the solution of the embodiment of the present application is also applicable to this scenario, that is, the first message, the second message, and the third message have the same message ID.
  • the first message, the second message, and the third message have the same CAN ID.
  • the message identifiers of the first message, the second message, and the third message may also be not limited.
  • the training process involved in the following can be performed by the above SEU or implemented by the cloud, which is not limited in the embodiment of the present application.
  • the architecture of the SEU may be shown in FIG. 1, and the training device 220 trains the abnormal message recognition model.
  • the training process is executed by the SEU, the architecture of the SEU may be shown in FIG. 1, and the training device 220 trains the abnormal message recognition model.
  • the training method of the abnormal message recognition model of the embodiment of the present application the following describes the architecture of cloud computing in conjunction with FIG.
  • FIG. 10 is a schematic diagram of a system architecture 1000 provided by an embodiment of the present application.
  • the execution device 1010 is implemented by one or more servers, and optionally, it cooperates with other computing devices, such as data storage, routers, load balancers and other devices; the execution device 1010 can be arranged on one physical site or distributed in multiple On the physical site.
  • the execution device 1010 can use the data in the data storage system 1050 or call the program code in the data storage system 1050 to implement the training method of the abnormal message recognition model in the embodiment of the present application.
  • the specific training method will be introduced below. For the sake of brevity, This will not be repeated here.
  • the user can operate respective user devices (for example, the local device 1001 and the local device 1002) to interact with the execution device 1010.
  • Each local device can represent any computing device, such as a personal computer, a computer workstation, a smart phone, a tablet computer, a smart car, or other types of cellular phones.
  • Each user's local device can interact with the execution device 1010 through a communication network of any communication mechanism/communication standard.
  • the communication network can be a wide area network, a local area network, a point-to-point connection, etc., or any combination thereof.
  • one or more aspects of the execution device 1010 may be implemented by each local device.
  • the local device 1001 may provide the execution device 1010 with local data or feedback calculation results.
  • the work of each layer in DNN can be expressed in mathematical expressions To describe: From the physical level, the work of each layer in the DNN can be understood as the transformation from the input space to the output space (that is, the row space of the matrix to the column space) through five operations on the input space (the set of input vectors) , These five operations include: 1. Dimension Up/Down; 2. Enlarge/Reduce; 3. Rotate; 4. Translation; 5. "Bend”. The operations of 1, 2, and 3 are determined by Completed, the operation of 4 is completed by +b, and the operation of 5 is realized by a(). The reason why the word "space” is used here is because the object to be classified is not a single thing, but a class of things, and space refers to the collection of all individuals of this class of things.
  • W is a weight vector, and each value in the vector represents the weight value of a neuron in the layer of neural network.
  • This vector W determines the spatial transformation from the input space to the output space described above, that is, the weight W of each layer controls how the space is transformed.
  • the purpose of training the DNN is to finally obtain the weight matrix of all layers of the trained neural network (the weight matrix formed by the vector W of many layers). Therefore, the training process of the neural network is essentially the way of learning the control space transformation, and more specifically the learning weight matrix.
  • Weight vector (Of course, there is usually an initialization process before the first update, that is, to pre-configure parameters for each layer in the DNN). For example, if the predicted value of the network is high, adjust the weight vector to make its prediction lower. Continue to adjust until the neural network can predict the target value you really want. Therefore, it is necessary to predefine "how to compare the difference between the predicted value and the target value". This is the loss function or objective function, which is used to measure the difference between the predicted value and the target value. Important equation. Among them, taking the loss function as an example, the higher the output value (loss) of the loss function, the greater the difference, and then the training of the DNN becomes a process of reducing this output value as much as possible.
  • FIG. 11 is a schematic flowchart of a training method of an abnormal message recognition model according to an embodiment of the present application.
  • the method shown in FIG. 11 includes step 1110 and step 1120.
  • the training data set includes N first training messages, and N identifiers of N difference classes corresponding to N first difference values corresponding to N first training messages, and N first difference values Is the difference between the eigenvalues of N first training messages and the corresponding eigenvalues of N second training messages, N first training messages correspond to N second training messages one-to-one, and N second training messages A message is a message that arrives before the corresponding N first training messages arrive at the target node.
  • Different difference classes of the N difference classes correspond to different value ranges of difference values, where N is a positive integer greater than 1.
  • the aforementioned target node is a node in the communication network that receives N first training messages and N second training messages.
  • the N first difference values are the difference between the characteristic value of each first training message and the characteristic value of the second training message in the N first training messages, that is, each first training message has a corresponding The second training message.
  • the above N first difference values may be partially the same, so as to improve the accuracy of training the abnormal message recognition model.
  • the foregoing N first training messages and N second training messages may have the same identifier.
  • the foregoing N first training messages and N second training messages may carry the same identifier. CAN ID.
  • the foregoing N second training messages may be the previous message of the corresponding first training message.
  • the aforementioned N second training messages may also be non-abnormal messages, so as to improve the accuracy of training the abnormal message recognition model.
  • the embodiment of the present application may not pay attention to whether the N second training messages are abnormal messages or non-abnormal messages.
  • the second training message is a non-abnormal message and the second training message is the previous message of the first training message
  • the previous training message of the first training message is a non-abnormal message
  • the previous The message is the second training message.
  • the previous training message of the first training message is an abnormal message
  • the above-mentioned second training message is a non-abnormal message with the shortest arrival time interval from the first training message.
  • 1120 Train the pre-stored original abnormal message recognition model based on the training data set to obtain the abnormal message recognition model.
  • the abnormal message recognition model is used to determine whether the message to be recognized is an abnormal message or a non-abnormal message.
  • N second difference values can also be input to the original anomaly message detection model, that is, the feature values of the N first training messages and the corresponding N non-anomalous N difference values between the feature values of the message (also known as the "third training message").
  • the training data set also includes N identifiers of N difference classes corresponding to the N second difference values of the N first training messages, and the N second difference values are the same as the feature values of the N first training messages.
  • N difference values between the characteristic values of the corresponding N third training messages the N first training messages correspond to the N third training messages one-to-one, and the N third training messages are in the corresponding first training message Messages that arrive before the target node, and the N third training messages are non-abnormal messages.
  • the foregoing N first training messages and N third training messages may have the same identifier.
  • the foregoing N first training messages and N third training messages may carry the same identifier. CAN ID.
  • the foregoing N third training messages may be the previous message of the corresponding first training message.
  • the foregoing N third training messages may be messages adjacent to the corresponding first training message, and the foregoing N third training messages may also be non-adjacent (or separated) from the corresponding first training message. information. Training a first message, for example, when the first message is a non-training on an exception message in the message 1, message 1 corresponding to the first to third training Training Training message adjacent the first message 1.
  • the first message 1 corresponding to the third training Training Training message with the first message is not adjacent to 1, this time, the first training message 1 corresponding to the third training The message is a non-abnormal message with the shortest time interval between the arrival of the first training message 1.
  • the second training message corresponding to the first training message is the same as the first training message.
  • the third training message corresponding to the training message may be a training message.
  • the first difference value corresponding to the first training message is the same as the first difference value corresponding to the first training message.
  • the aforementioned characteristic value may be the arrival time of the message
  • the N first difference values are the arrival time interval between the N first training messages and the corresponding N second training messages
  • the N second difference values It is the arrival time interval between N first training messages and corresponding N third training messages.
  • Table 1 lists the information corresponding to the 6 messages in the training data set. It should be noted that the sequence numbers of the six messages shown in Table 1 are only for ease of description, and may not exist in the actual training data set.
  • the first difference type identifier I diff corresponding to message 1 is 0, the corresponding message identifier I ID is "768", the corresponding message length I Len is 8 bytes, and the corresponding first byte I P1 is the payload 207, corresponding to the second payload byte of I P2 188, the payload corresponding to the third byte of the 78 I P3, corresponding to the fourth payload byte of the 61 I P4 ,
  • the payload in the corresponding fifth byte IP5 is 0, the payload in the corresponding sixth byte IP6 is 0, and the payload in the corresponding seventh byte IP7 is 128, which corresponds to eighth byte payload in the range 232 I P8,
  • the second difference corresponding class identifier I honst-diff is 0, the corresponding label (label) is 1, a message indicating a non-exception message.
  • the identifier I diff of the first difference category corresponding to message 2 is 0, the corresponding message identifier I ID is "768", the corresponding message length I Len is 8 bytes, and the corresponding payload in the first byte I P1 207, corresponding to the second payload byte of I P2 188, the payload corresponding to the third byte of the 78 I P3, corresponding to the fourth payload byte of the 61 I P4 ,
  • the payload in the corresponding fifth byte IP5 is 0, the payload in the corresponding sixth byte IP6 is 0, and the payload in the corresponding seventh byte IP7 is 144, corresponding to eighth byte payload I P8 is 216, the corresponding class identification of the second difference I honst-diff is 0, the corresponding tags is 1, 2 a message indicating that a non-exception message.
  • the identifier I diff of the first difference category corresponding to message 3 is 0, the corresponding message identifier I ID is "769", the corresponding message length I Len is 8 bytes, and the corresponding payload in the first byte I P1 payload 20, corresponding to the second byte in the I P2 is 66, the payload corresponding to the third byte of the 72 I P3, corresponding to the fourth payload byte of the 112 I P4 ,
  • the payload in the corresponding fifth byte IP5 is 90
  • the payload in the corresponding sixth byte IP6 is 40
  • the payload in the corresponding seventh byte IP7 is 144
  • corresponding to eighth byte payload I P8 is 94
  • corresponding to the second class identifies the difference I honst-diff is 0, the corresponding tags is 1, message 3 represents a non-exception message.
  • the first difference type identifier I diff corresponding to message 4 is 0, the corresponding message identifier I ID is "769", the corresponding message length I Len is 8 bytes, and the corresponding first byte I P1 is the payload 67, the payload corresponding to the second byte in the range 127 I P2, the payload corresponding to the third byte in the I P3 is 29, corresponding to the fourth payload byte of the 195 I P4 ,
  • the corresponding payload in the fifth byte IP5 is 107
  • the corresponding payload in the sixth byte IP6 is 214
  • the corresponding payload in the seventh byte IP7 is 178
  • corresponding to eighth byte payload I P8 is 228, the corresponding class identification of the second difference I honst-diff -1, -1 corresponding label indicating that the message is an abnormal message 4.
  • the identifier I diff of the first difference category corresponding to message 5 is 0, the corresponding message identifier I ID is "768", the corresponding message length I Len is 8 bytes, and the corresponding first byte I P1 is the payload 207, a payload corresponding to the second byte in the range 180 I P2, the payload corresponding to the third byte of the 78 I P3, corresponding to the fourth payload byte of the 61 I P4 ,
  • the payload in the corresponding fifth byte IP5 is 0, the payload in the corresponding sixth byte IP6 is 0, and the payload in the corresponding seventh byte IP7 is 160, which corresponds to eighth byte payload I P8 is 208, the corresponding class identification of the second difference I honst-diff is 2, the corresponding tags is 1, 5 denotes a non-message exception message.
  • the first difference type identifier I diff corresponding to message 6 is 0, the corresponding message identifier I ID is "913", the corresponding message length I Len is 8 bytes, and the corresponding first byte I P1 is the payload 72, the payload corresponding to the second byte I P2 is 11, the payload corresponding to the third byte I P3 is 0, the payload corresponding to the fourth byte I P4 is 0 ,
  • the corresponding payload in the fifth byte IP5 is 100
  • the corresponding payload in the sixth byte IP6 is 50
  • the corresponding payload in the seventh byte IP7 is 16
  • corresponding to eighth byte payload I P8 is 135, the corresponding class identification of the second difference I honst-diff is 2, the corresponding tags is 1, a message indicating the non-6 exception message.
  • FIG. 12 shows a schematic flowchart of a training method of an abnormal message recognition model according to another embodiment of the present application.
  • the above-mentioned target difference value may be the above-mentioned first difference value or the above-mentioned second difference value.
  • the foregoing multiple first training messages may be N first training messages included in the foregoing training data set, or may be first training messages that are not related to the N first training messages included in the foregoing training data set. This is not specifically limited.
  • 1140 Determine the first value range of the target difference value according to the maximum value and the minimum value.
  • the above maximum value can be used as the upper limit of the value range
  • the above minimum value can be used as the lower limit of the value range
  • the continuous interval between the upper limit of the value range and the lower limit of the value range can be used as the value range.
  • the multiple difference classes corresponding to the multiple value ranges are the above N difference classes.
  • the first value range may be divided into multiple value ranges based on the Jenks natural breakpoint algorithm.
  • This method is designed to determine the best configuration for dividing the target difference value into different difference classes. Therefore, this method reduces the difference within the difference class and maximizes the difference between the difference classes. It is divided based on the Jenks natural breakpoint algorithm
  • the difference class is also known as the Jenks class.
  • the above-mentioned first value range can be directly divided into intervals of equal size. Therefore, the divided difference class is also called a linear class.
  • the first value range may also be divided into multiple intervals containing the same number of training messages.
  • the first difference value and/or the second difference value corresponding to the N first training messages can be mapped to the difference type interval, that is, in step 1160, the N first training messages are mapped to The N first difference values and/or N second difference values are mapped to the corresponding difference classes to determine the difference class identifiers corresponding to the N first difference values, and/or the difference class identifiers corresponding to the N second difference values .
  • the above steps 1130 to 1160 can be understood as a preparation process before training the original abnormal message recognition model.
  • the characteristic value is the arrival time
  • Table 1 is the training data set as an example to introduce the generation process from Table 2 to Table 1, that is, the "preparation process" above.
  • Table 2 shows a possible implementation of the data set of the embodiment of the present application. It should be noted that the identifiers used for the parameters with the same meaning in Table 2 and Table 1 are the same. For the sake of brevity, details are not described in detail below. In addition, the sequence numbers of the six messages shown in Table 2 are only for convenience of explanation, and may not exist in the actual training data set.
  • the first difference value t diff corresponding to message 1 is 0, and the corresponding second difference value t honst-diff is 0.
  • the first difference value t diff corresponding to message 2 is 0.014914, and the corresponding second difference value t honst-diff is 0.014914.
  • the first difference value t diff corresponding to message 3 is 0.014706, and the corresponding second difference value t honst-diff is 0.014706.
  • the first difference value t diff corresponding to message 4 is 0, and the corresponding second difference value t honst-diff is 0.
  • the first difference value t diff corresponding to message 5 is 0.020089, and the corresponding second difference value t honst-diff is 0.020089.
  • the first difference value t diff corresponding to message 6 is 0.049258, and the corresponding second difference value t honst-diff is 0.049258.
  • the message with the message ID of 768 can correspond to 5 difference classes.
  • the value range corresponding to the difference class 0 is [0.0,0.01752499999997781]
  • the value corresponding to the difference class 1 The range is (0.01752499999997781, 0.019290000000182772]
  • the value range corresponding to difference type 2 is (0.019290000000182772, 0.020568000000366737)
  • the value range corresponding to difference type 3 is (0.020568000000366737, 0.022227000000043518)
  • the value range corresponding to difference type 4 is (0.022227000000043518, 0.02717000000001235].
  • the message with the message ID of 769 can correspond to 5 difference classes.
  • the value range corresponding to difference class 0 is [0.0,0.01753699999999725]
  • the value range corresponding to difference class 1 is (0.01753699999999725, 0.019297000000278786]
  • the value range corresponding to difference class 2 is The value range is (0.019297000000278786, 0.020578000000227803]
  • the value range corresponding to difference type 3 is (0.020578000000227803, 0.022238000000015745]
  • the value range corresponding to difference type 4 is (0.022238000000015745, 0.027170999999995615).
  • the message with the message ID 913 can correspond to 5 difference classes.
  • the value range corresponding to difference class 0 is [0.0,0.047295999999732885]
  • the value range corresponding to difference class 1 is (0.047295999999732885,0.04900800000001482]
  • the value range corresponding to difference class 2 is (0.047295999999732885,0.04900800000001482).
  • the value range is (0.04900800000001482, 0.05000099999998042]
  • the value range corresponding to difference type 3 is (0.05000099999998042, 0.05100100000004204]
  • the value range corresponding to difference type 4 is (0.05100100000004204, 0.052717999999913445).
  • the message ID of message 1 is "768”
  • the corresponding first difference value t diff is 0, which belongs to the value range [0.0,0.01752499999997781] corresponding to difference class 0
  • the corresponding first difference class identifier I diff is 0 ,As shown in Table 1.
  • the second difference value t honst-diff corresponding to message 1 is 0 and also belongs to the value range corresponding to difference class 0 [0.0,0.01752499999997781], and the corresponding identifier I honst-diff of the second difference class is 0, as shown in Table 1. Show.
  • the message identifier of Message 2 is "768", and the corresponding first difference value t diff is 0.0149414, which belongs to the value range [0.0,0.01752499999997781] corresponding to difference class 0 , and the corresponding first difference class identifier I diff is 0, such as Table 1 shows.
  • the second difference value t honst-diff corresponding to message 2 is 0.0149414 and also belongs to the value range [0.0,0.01752499999997781] corresponding to difference class 0
  • the corresponding identifier I honst-diff of the second difference class is 0, as shown in Table 1. Show.
  • the message identifier of message 3 is "769", and the corresponding first difference value t diff is 0, which belongs to the value range [0.0,0.01753699999999725] corresponding to difference class 0 , and the corresponding first difference type identifier I diff is 0, such as Table 1 shows.
  • the second difference value t honst-diff corresponding to message 3 is 0 and also belongs to the value range [0.0,0.01753699999999725] corresponding to difference class 0 , and the corresponding identifier I honst-diff of the second difference class is 0, as shown in Table 1. Show.
  • the message ID of message 4 is "769", and the corresponding first difference value t diff is 0, which belongs to the value range [0.0,0.01753699999999725] corresponding to difference class 0 , and the corresponding first difference class identifier I diff is 0, such as Table 1 shows.
  • the second difference value t honst-diff corresponding to message 4 is 0 and also belongs to the value range [0.0,0.01753699999999725] corresponding to difference class 0 , and the corresponding identifier I honst-diff of the second difference class is 0, as shown in Table 1. Show.
  • the message identifier of message 5 is "768", and the corresponding first difference value t diff is 0.020089, which belongs to the value range corresponding to difference class 2 (0.019290000000182772, 0.020568000000366737), then the corresponding first difference type identifier I diff is 2, such as As shown in Table 1.
  • the second difference value t honst-diff corresponding to message 5 is 0.020089 and also belongs to the value range corresponding to difference class 2 (0.019290000000182772, 0.020568000000366737), then the corresponding second difference class identifier I honst-diff is 2 ,As shown in Table 1.
  • the message ID of message 6 is "913", and the corresponding first difference value t diff is 0.049258, which belongs to the value range corresponding to difference class 2 (0.04900800000001482, 0.05000099999998042], then the corresponding first difference class ID I diff is 2, such as As shown in Table 1.
  • the second difference value t honst-diff corresponding to message 6 is 0.049258 and also belongs to the value range corresponding to difference class 2 (0.04900800000001482, 0.05000099999998042), then the corresponding second difference class identifier I honst-diff is 2. ,As shown in Table 1.
  • the first difference category and the second difference category may be the same difference category or different difference categories.
  • the above-mentioned first difference category and the second difference category can be determined separately, and the specific process of the determination can be referred to the above description, and will not be described in detail for the sake of brevity.
  • the above preparation process can also be directly configured by the manufacturer.
  • the manufacturer uses multiple arrival time intervals corresponding to each ID as the value range corresponding to the multiple difference classes. .
  • the embodiments of the present application do not specifically limit this.
  • the above describes the abnormal message identification method of the application embodiment in combination with the preparation process, the training process, and the reasoning process.
  • the method of the embodiment of the application has higher accuracy.
  • Tables 3 and 4 the simulation results regarding the accuracy of the solutions of the embodiments of the present application in different scenarios are introduced.
  • Table 3 shows the accuracy rate when the method of the embodiment of the present application is applied to the evaluation of a camouflage attack.
  • Table 4 shows the accuracy rate when the method of the embodiment of the present application is applied to a random disk operating system (DOS) attack.
  • DOS disk operating system
  • each message ID corresponds to 6 different types. These 6 different types include a difference type for the difference value of the abnormal message. Ranges.
  • TP True Positives
  • FP False Positives/False Positives
  • TN True Negative
  • FP False Negatives/Leak
  • TP represents the number of times a message is predicted to be a positive type and the message is a positive type in the process of using an abnormal message recognition model to identify.
  • FP represents the number of times a message is predicted to be a negative and a positive message in the process of using an abnormal message recognition model to identify.
  • TN represents the number of times a message is predicted to be a negative class and the message is a negative class in the process of using an abnormal message recognition model to identify.
  • FN represents the number of times a message is predicted to be negative and positive in the process of using the abnormal message recognition model to identify.
  • the above-mentioned negative class is used to indicate that the message is an abnormal message
  • the above-mentioned positive class is used to indicate that the message is a non-abnormal message
  • Table 3 shows that the accuracy rates of the method for identifying masquerading attacks adopted in the embodiments of the present application are the accuracy rates of tests C3 to C6, which are respectively: 99.60, 99.61, 99.33, and 99.99.
  • the accuracy of the traditional method of identifying masquerading attacks is 98.37 and 99.52 for testing C1 and C2, respectively.
  • the accuracy of tests C3 to C6 is higher than the accuracy of tests C1 and C2.
  • Table 4 shows that the accuracy rates of the method for identifying random DOS attacks according to the embodiments of the present application are the accuracy rates of tests R3 to R6, which are respectively 99.95, 99.89, 98.21, and 99.94.
  • the accuracy of the traditional method of identifying random DOS attacks is the accuracy of testing R1 and R2, which are 97.81 and 99.90 respectively.
  • the accuracy of testing R3 to R6 is generally higher than that of testing R1 and R2.
  • FIG. 13 is a schematic diagram of an abnormal message identification device according to an embodiment of the present application.
  • the apparatus 1300 shown in FIG. 13 includes: a receiving unit 1310 and a processing unit 1320.
  • the receiving unit 1310 is configured to receive a first message and determine a first difference value between a characteristic value of the first message and a characteristic value of a second message, where the second message is before receiving the first message Received message;
  • the processing unit 1320 is configured to determine a difference class corresponding to the first difference value from a plurality of preset difference classes, and different difference classes in the plurality of difference classes correspond to different value ranges of the difference value;
  • the processing unit 1320 is further configured to input the identifier of the difference category corresponding to the first difference value into a pre-stored abnormal message identification model to determine whether the first message is an abnormal message or a non-abnormal message.
  • the characteristic value is the arrival time of the message
  • the first difference value is the arrival time interval between the arrival time of the first message and the arrival time of the second message.
  • the processing unit 1320 is further configured to: determine a second difference value between the characteristic value of the first message and the characteristic value of the third message, where the third message is the time when the first message is received.
  • the previously received non-abnormal message determine the difference category corresponding to the second difference value from the plurality of difference categories; correspond to the identifier of the difference category corresponding to the first difference value and the second difference value
  • the identification of the difference type is input into the abnormal message identification model to determine whether the first message is an abnormal message or a non-abnormal message.
  • the characteristic value is the arrival time of the message
  • the second difference value is the arrival time interval between the arrival time of the first message and the arrival time of the third message.
  • the second message is a non-abnormal message.
  • different value ranges of the difference values corresponding to different difference classes in the plurality of difference classes belong to multiple preset value ranges, and the preset multiple value ranges are based on a natural breakpoint algorithm (For example, Jenks natural breakpoint algorithm), obtained by dividing the first value range of the feature value, and the upper limit of the first value range is the feature value in the training data set of the abnormal message recognition model Corresponding to the maximum value, the lower limit of the first value range is the minimum value corresponding to the characteristic value in the data set.
  • a natural breakpoint algorithm For example, Jenks natural breakpoint algorithm
  • the processing unit is further configured to: determine characteristic information of the first message, where the characteristic information of the first message includes load data corresponding to each byte in the payload of the first message, One or more of the length of the first message or the message identifier of the first message; input the identifier of the difference category corresponding to the first difference value and the characteristic information of the first message into the Exception message recognition model.
  • Fig. 14 is a schematic diagram of a training device for an abnormal message recognition model according to an embodiment of the present application.
  • the device shown in FIG. 14 includes: an acquiring unit 1410 and a processing unit 1420.
  • the acquiring unit 1410 is configured to acquire a training data set, the training data set including N first training messages, and N identifiers of N difference classes corresponding to the N first difference values of the N first training messages, the The N first difference values are the difference values between the characteristic values of the N first training messages and the corresponding N second training messages, and the N first training messages are different from the N first training messages.
  • One-to-one correspondence between the two training messages, the N second training messages are messages that arrive before the corresponding N first training messages arrive at the target node, and different difference classes in the N difference classes correspond to different difference values
  • the processing unit 1420 is configured to train a pre-stored original abnormal message recognition model based on the training data set to obtain an abnormal message recognition model, and the abnormal message recognition model is used to determine whether a message to be recognized is an abnormal message or a non-abnormal message.
  • the training data set further includes N identifiers of the N difference classes corresponding to the N second difference values of the N first training messages, and the N second difference values are the N pieces N difference values between the eigenvalues of the first training message and the eigenvalues of the corresponding N third training messages, the N first training messages and the N third training messages are in one-to-one correspondence, the The N third training messages are messages that arrive before the corresponding first training message reaches the target node, and the N third training messages are non-abnormal messages.
  • the characteristic value is the arrival time of the message
  • the N first difference values are the arrival time interval between the N first training messages and the corresponding N second training messages
  • the N The second difference value is the arrival time interval between the N first training messages and the corresponding N third training messages.
  • the processing unit 1420 is further configured to: determine the maximum value of the feature value and the minimum value of the feature value of the multiple training messages; determine the feature value according to the maximum value and the minimum value
  • the value range of the characteristic value is divided into a plurality of non-overlapping sub-ranges, and each sub-range corresponds to a first difference category.
  • the receiving unit 1310 may be the input/output interface 1530 of the computing device 1500
  • the processing unit 1320 may be the processor 1520 of the computing device 1500
  • the computing device 1500 may further include a memory 1510, specifically As shown in Figure 15.
  • the acquiring unit 1410 may be an input/output interface 1530 of the computing device 1500
  • the processing unit 1520 may be a processor 1520 of the computing device 1500
  • the computing device 1500 may further include a memory 1510 , As shown in Figure 15.
  • FIG. 15 is a schematic diagram of a computing device according to another embodiment of the present application.
  • the computing device 1500 shown in FIG. 15 may include: a memory 1510, a processor 1520, and an input/output interface 1530.
  • the memory 1515, the processor 1520, and the input/output interface 1530 are connected by an internal connection path.
  • the memory 1515 is used to store instructions
  • the processor 1520 is used to execute the instructions stored in the memory 1520 to control the input/output interface 1530 to receive Input data and information, output operation results and other data.
  • each step of the above method can be completed by an integrated logic circuit of hardware in the processor 1520 or instructions in the form of software.
  • the method for identifying the abnormal message and/or the method for training the abnormal message recognition model disclosed in the embodiments of the present application can be directly embodied as the completion of execution by a hardware processor, or a combination of hardware and software modules in the processor.
  • the software module can be located in a mature storage medium in the field, such as random access memory, flash memory, read-only memory, programmable read-only memory, or electrically erasable programmable memory, registers.
  • the storage medium is located in the memory 1510, and the processor 1520 reads the information in the memory 1510, and completes the steps of the foregoing method in combination with its hardware. To avoid repetition, it will not be described in detail here.
  • the processor may be a central processing unit (central processing unit, CPU), and the processor may also be other general-purpose processors, digital signal processors (digital signal processors, DSP), and dedicated integration Circuit (application specific integrated circuit, ASIC), ready-made programmable gate array (field programmable gate array, FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc.
  • the general-purpose processor may be a microprocessor or the processor may also be any conventional processor or the like.
  • the memory may include a read-only memory and a random access memory, and provides instructions and data to the processor.
  • a part of the processor may also include a non-volatile random access memory.
  • the processor may also store device type information.
  • B corresponding to A means that B is associated with A, and B can be determined according to A.
  • determining B based on A does not mean that B is determined only based on A, and B can also be determined based on A and/or other information.
  • the size of the sequence number of the above-mentioned processes does not mean the order of execution, and the execution order of each process should be determined by its function and internal logic, and should not correspond to the embodiments of the present application.
  • the implementation process constitutes any limitation.
  • the disclosed system, device, and method can be implemented in other ways.
  • the device embodiments described above are merely illustrative.
  • the division of the units is only a logical function division, and there may be other divisions in actual implementation, for example, multiple units or components may be combined or It can be integrated into another system, or some features can be ignored or not implemented.
  • the displayed or discussed mutual coupling or direct coupling or communication connection may be indirect coupling or communication connection through some interfaces, devices or units, and may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the objectives of the solutions of the embodiments.
  • the functional units in the various embodiments of the present application may be integrated into one processing unit, or each unit may exist alone physically, or two or more units may be integrated into one unit.
  • the computer program product includes one or more computer instructions.
  • the computer may be a general-purpose computer, a dedicated computer, a computer network, or other programmable devices.
  • the computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from a website, computer, server, or data center.
  • the computer-readable storage medium may be any available medium that can be read by a computer or a data storage device such as a server or a data center integrated with one or more available media.
  • the usable medium may be a magnetic medium (for example, a floppy disk, a hard disk, a magnetic tape), an optical medium (for example, a Digital Video Disc (DVD)) or a semiconductor medium (for example, a Solid State Disk (SSD)) )Wait.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Mining & Analysis (AREA)
  • Computing Systems (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • Artificial Intelligence (AREA)
  • General Physics & Mathematics (AREA)
  • Evolutionary Computation (AREA)
  • Computational Linguistics (AREA)
  • Molecular Biology (AREA)
  • General Health & Medical Sciences (AREA)
  • Biophysics (AREA)
  • Biomedical Technology (AREA)
  • Mathematical Physics (AREA)
  • Software Systems (AREA)
  • Health & Medical Sciences (AREA)
  • Computer Security & Cryptography (AREA)
  • Bioinformatics & Computational Biology (AREA)
  • Computer Vision & Pattern Recognition (AREA)
  • Evolutionary Biology (AREA)
  • Bioinformatics & Cheminformatics (AREA)
  • Computer Hardware Design (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Automation & Control Theory (AREA)
  • Mechanical Engineering (AREA)
  • Debugging And Monitoring (AREA)

Abstract

本申请提供了一种异常消息的识别方法、异常消息识别模型的训练方法及装置。本申请实施例的方法适用于汽车或船舶领域。其中上述异常消息的识别方法包括：安全执行单元SEU接收第一消息，并确定所述第一消息的特征值与第二消息的特征值之间的第一差异值，所述第二消息为在接收所述第一消息之前接收到的消息；所述SEU从预设的多个差异类中确定所述第一差异值对应的差异类，所述多个差异类中不同的差异类对应差异值的不同的取值范围；所述SEU将所述第一差异值对应的差异类的标识输入预存的异常消息识别模型，以确定所述第一消息为异常消息或非异常消息。有利于提高基于异常消息识别模型进行异常消息识别的准确度。

Description

异常消息的识别方法和装置 技术领域
本申请涉及信息技术领域，更具体地涉及异常消息的识别方法、异常消息识别模型的训练方法及装置。
背景技术
随着汽车的电动化，车载通信网络支持的电子控制系统、传感器、致动器、电子控制单元(electronic control unit，ECU)以及通信接口不断增加，使得车载通信网络以及通过通信系统进行通信的部件越来越容易受到攻击，例如，网络攻击、黑客攻击、干扰车载网络的操作等，可能会危及车辆安全和性能。上述车辆中电子控制系统日益复杂的情况，增加了识别、检测车辆中的各部件之间的异常消息的难度。
目前，通常采用入侵检测系统(intrusion detection system，IDS)对车辆中的异常消息进行识别。IDS是一种对网络传输进行即时监视，在发现可疑传输时发出警报或者采取主动反应措施的网络安全设备。IDS主要是基于机器学习(machine learning，ML)实现的，即通过基于机器学习的方法对异常消息识别模型进行训练，并使用训练完成的异常消息识别模型对车辆中传输的信息进行识别，以提高信息传输的安全性。
基于现有的异常消息识别方案，在对异常消息识别模型进行训练时，仅输入两条消息之间的特征值的差异值(例如，到达时间间隔)，后期在基于该异常消息识别模型对异常消息进行识别时，也是基于两条消息之间的差异值进行的。然而，实际情况中每两条消息都不是严格按照一个相同的差异值进行传输的，每两条消息之间可能对应多种差异值，这样，上述基于差异值进行训练得出的异常消息识别模型不够准确，继而也会降低基于该异常消息识别模型识别异常消息的准确度。
发明内容
本申请提供一种异常消息的识别方法、异常消息识别模型的训练方法及装置，以提高异常消息识别模型的准确性，进而提高基于该异常消息识别模型识别异常消息的准确度。
第一方面，提供了一种识别异常消息的方法，包括：安全执行单元SEU接收第一消息，并确定所述第一消息的特征值与第二消息的特征值之间的第一差异值，所述第二消息为在接收所述第一消息之前接收到的消息；所述SEU从预设的多个差异类中确定所述第一差异值对应的差异类，所述多个差异类中不同的差异类对应差异值的不同的取值范围；所述SEU将所述第一差异值对应的差异类的标识输入预存的异常消息识别模型，以确定所述第一消息为异常消息或非异常消息。
在本申请实施例中，通过将两条消息的特征值之间的差异值对应的取值范围划分为多个差异类，并将多个差异类中第一差异值对应的差异类的标识输入异常消息识别模型，以确定第一消息为异常消息或非异常消息，避免了现有技术中，仅向异常消息识别模型输入 两个消息之间的特征值的差异值(例如，到达时间间隔)，有利于提高基于异常消息识别模型进行异常消息识别的准确度。
可选地，上述第二消息为非异常消息。有利于避免由于第二消息为异常消息而导致第二消息的特征值异常，从而影响第一差异值，有利于提高基于异常消息识别模型进行异常消息识别的准确度。
在一种可能的实现方式中，所述特征值为消息的到达时间，所述第一差异值为所述第一消息的到达时间与所述第二消息的到达时间之间的到达时间间隔。
在本申请实施例中，通过将两条消息之间的到达时间间隔对应的取值范围划分为多个差异类，并将多个差异类中第一消息与第二消息之间的到达时间间隔对应的差异类的标识输入异常消息识别模型，以确定第一消息为异常消息或非异常消息，有利于提高基于异常消息识别模型进行异常消息识别的准确度。
在一种可能的实现方式中，所述方法还包括：所述SEU确定所述第一消息的特征值与第三消息的特征值之间的第二差异值，所述第三消息为在接收所述第一消息之前接收到的非异常消息；所述SEU从所述多个差异类中确定所述第二差异值对应的差异类；所述SEU将所述第一差异值对应的差异类的标识输入预存的异常消息识别模型，以确定所述第一消息为异常消息或非异常消息，包括：所述SEU将所述第一差异值对应的差异类的标识，以及所述第二差异值对应的差异类的标识输入所述异常消息识别模型，以确定所述第一消息为异常消息或非异常消息。
在本申请实施例中，确定第一消息的特征值与第三消息的特征值之间的第二差异值，并将第二差异值对应的差异类的标识与第一差异值对应的差异类的标识都出入异常消息识别模型，有利于提高基于异常消息识别模型进行异常消息识别的准确度。
在一种可能的实现方式中，所述特征值为消息的到达时间，所述第二差异值为所述第一消息的到达时间与所述第三消息的到达时间之间的到达时间间隔。
在本申请实施例中，确定第一消息与第三消息之间的到达时间间隔，并将第一消息与第三消息之间的到达时间间隔对应的差异类的标识，与第一消息与第二消息之间的到达时间间隔对应的差异类的标识都出入异常消息识别模型，有利于提高基于异常消息识别模型进行异常消息识别的准确度。
在一种可能的实现方式中，所述多个差异类中不同的差异类对应差异值的不同的取值范围属于预设的多个取值范围，所述预设的多个取值范围是基于自然断点算法，对所述特征值的第一取值范围进行划分得到的，所述第一取值范围的上限为所述异常消息识别模型的训练数据集中所述特征值对应的最大值，所述第一取值范围的下限为所述数据集中所述特征值对应的最小值。
在本申请实施例中，基于自然断点算法将特征值对应的第一取值范围划分为上述多个取值范围，以对应不同的差异类，有利于提高多个取值范围划分的合理性。
在一种可能的实现方式中，所述方法还包括：所述SEU确定所述第一消息的特征信息，所述第一消息的特征信息包括所述第一消息的有效载荷中每个字节对应的载荷数据的，所述第一消息的长度或所述第一消息的消息标识中的一种或多种；所述SEU将所述第一差异值对应的差异类的标识输入预存的异常消息识别模型，包括：所述SEU将所述第一差异值对应的差异类的标识以及所述第一消息的特征信息，输入所述异常消息识别模 型。
在本申请实施例中，将所述第一差异值对应的差异类的标识以及所述第一消息的特征信息，输入所述异常消息识别模型，有利于提高异常消息识别模型识别异常消息的准确性。
第二方面，提供一种异常消息识别模型的训练方法，包括：获取训练数据集，所述训练数据集包含N条第一训练消息，以及N条第一训练消息的N个第一差异值对应的N个差异类的N个标识，所述N个第一差异值为所述N条第一训练消息的特征值与对应的N条第二训练消息的特征值之间的差异值，所述N条第一训练消息与所述N条第二训练消息一一对应，所述N条第二训练消息为在对应的所述N条第一训练消息到达目标节点之前到达的消息，所述N个差异类中不同的差异类对应差异值不同的取值范围，其中，N为大于1的正整数；基于所述训练数据集对预存的原始异常消息识别模型进行训练，得到异常消息识别模型，所述异常消息识别模型用于确定待识别消息为异常消息或非异常消息。
在本申请实施例中，通过将N条第一训练消息的N个第一差异值对应的N个差异类的N个标识作为训练数据集，并基于该训练数据集对原始异常消息识别模型进行训练，避免了现有技术中，直接基于将两个消息之间的特征值的差异值(例如，到达时间间隔)，对原始异常消息识别模型进行训练，有利于提高基于异常消息识别模型进行异常消息识别的准确度。
可选地，上述N条第一训练消息的特征值可以为N条第一训练消息到达目标节点的到达时间，N条第二训练消息的特征值可以为N条第二训练消息到达目标节点的到达时间，上述N条第一训练消息的N个第一差异值，可以为N条第一训练消息与N条第二训练消息到达目标节点的到达时间间隔。
在本申请实施例中，通过将N条第一训练消息的N个第一差异值对应的N个差异类的N个标识作为训练数据集中的训练数据，并基于该训练数据集对原始异常消息识别模型进行训练，避免了现有技术中，直接基于将两个消息之间的特征值的差异值(例如，到达时间间隔)，对原始异常消息识别模型进行训练，有利于提高基于异常消息识别模型进行异常消息识别的准确度。
可选地，上述N条第二训练消息中的至少部分消息为非异常消息。有利于避免由于第二消息为异常消息而导致第二消息的特征值异常，从而影响第一差异值，有利于提高基于异常消息识别模型进行异常消息识别的准确度。
在一种可能的实现方式中，所述训练数据集还包括所述N条第一训练消息的N个第二差异值对应的N个差异类的N个标识，所述N个第二差异值为所述N条第一训练消息的特征值与对应的N条第三训练消息的特征值之间的N个差异值，所述N条第一训练消息与所述N条第三训练消息一一对应，所述N条第三训练消息为在对应的第一训练消息到达所述目标节点之前到达的消息，且所述N条第三训练消息为非异常消息。
在本申请实施例中，通过将N条第一训练消息的N个第二差异值对应的N个差异类的N个标识作为训练数据集，其中N条第三训练消息为非异常消息，并基于该训练数据集对原始异常消息识别模型进行训练，有利于提高基于异常消息识别模型进行异常消息识别的准确度。
可选地，上述N条第一训练消息的特征值可以为N条第一训练消息到达目标节点的到达时间，N条第三训练消息的特征值可以为N条第三训练消息到达目标节点的到达时 间，上述N条第一训练消息的N个第二差异值，可以为N条第一训练消息与N条第三训练消息到达目标节点的到达时间间隔。
在本申请实施例中，通过将N条第一训练消息的N个第二差异值对应的N个差异类的N个标识作为训练数据集中的训练数据，并基于该训练数据集对原始异常消息识别模型进行训练，避免了现有技术中，直接基于将两个消息之间的特征值的差异值(例如，到达时间间隔)，对原始异常消息识别模型进行训练，有利于提高基于异常消息识别模型进行异常消息识别的准确度。
在一种可能的实现方式中，在基于所述训练数据集对预存的原始异常消息识别模型进行训练，得到异常消息识别模型之前，所述方法还包括：确定所述多条训练消息的特征值的最大值和所述特征值的最小值；根据所述最大值和所述最小值确定所述特征值的取值范围；将所述特征值的取值范围划分为不重叠的多个子范围，每个子范围对应一个第一差异类。
在本申请实施例中，基于多条训练消息的特征值的最大值和所述特征值的最小值，确定特征值的取值范围，并将所述特征值的取值范围划分为不重叠的多个子范围，其中，每个子范围对应一个第一差异类，即提供了一种确定多个差异类的通用方法，以扩大本申请实施例的应用场景。
第三方面，提供了一种识别异常消息的装置，所述装置包括用于执行第一方面或第一方面任一种可能实现方式中的各个单元。
第四方面，提供了一种识别异常消息的装置，所述装置包括用于执行第二方面或第二方面任一种可能实现方式中的各个单元。
第五方面，提供了一种识别异常消息的装置，所述装置具有实现上述第一方面的方法设计中的装置的功能。这些功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个与上述功能相对应的单元。
第六方面，提供了一种识别异常消息的装置，所述装置具有实现上述第二方面的方法设计中的装置的功能。这些功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个与上述功能相对应的单元。
第七方面，提供了一种计算设备，包括输入输出接口、处理器和存储器。该处理器用于控制输入输出接口收发信号或信息，该存储器用于存储计算机程序，该处理器用于从存储器中调用并运行该计算机程序，使得该计算设备执行上述第一方面中的方法。
第八方面，提供了一种计算设备，包括输入输出接口、处理器和存储器。该处理器用于控制输入输出接口收发信号或信息，该存储器用于存储计算机程序，该处理器用于从存储器中调用并运行该计算机程序，使得该计算设备执行上述第二方面中的方法。
第九方面，提供了一种计算机程序产品，所述计算机程序产品包括：计算机程序代码，当所述计算机程序代码在计算机上运行时，使得计算机执行上述各方面中的方法。
第十方面，提供了一种计算机可读介质，所述计算机可读介质存储有程序代码，当所述计算机程序代码在计算机上运行时，使得计算机执行上述各方面中的方法。
第十一方面，提供了一种芯片系统，该芯片系统包括处理器，用于计算设备实现上述方面中所涉及的功能，例如，生成，接收，发送，或处理上述方法中所涉及的数据和/或信息。在一种可能的设计中，所述芯片系统还包括存储器，所述存储器，用于保存终端设 备必要的程序指令和数据。该芯片系统，可以由芯片构成，也可以包括芯片和其他分立器件。
附图说明
图1是本申请实施例的异常消息识别模型应用的系统架构的示意图。
图2是本申请实施例的运行异常消息识别模型的硬件设备的示意图。
图3是本申请实施例适用的车辆300的功能框图。
图4示出了传统的异常消息识别模型的示意图。
图5是本申请实施例的异常消息的识别方法示意性流程图。
图6是本申请实施例中到达时间间隔与多个差异类之间的对应关系的示意图。
图7是本申请实施例的异常消息识别模型的示意图。
图8是本申请另一实施例的异常消息识别方法的流程图。
图9是本申请另一实施例的异常消息识别模型的示意图。
图10是本申请实施例提供了一种系统架构1000的示意图。
图11是本申请实施例的异常消息识别模型的训练方法的示意性流程图。
图12是本申请另一实施例的异常消息识别模型的训练方法的示意性流程图。
图13是本申请实施例的异常消息的识别装置的示意图。
图14是本申请实施例的异常消息识别模型的训练装置的示意图。
图15是本申请另一实施例的计算设备的示意图。
具体实施方式
下面将结合附图，对本申请中的技术方案进行描述。
为了便于理解，下文结合图1介绍本申请实施例的异常消息识别模型应用的系统架构的示意图。图1所示的系统100包括执行设备210、训练设备220、数据库230、客户设备240、数据存储系统250以及数据采集设备260。
数据采集设备260用于采集消息的特征数据并存入数据库230，训练设备220基于数据库230中维护的训练数据生成目标模型/规则201(即上文的异常消息识别模型)。下面将更详细地描述训练设备220如何基于训练数据得到目标模型/规则201，以使得目标模型/规则201能够识别异常消息。
需要说明的是，上述异常消息识别模型的训练过程请参见下文中图所示的方法，为了简洁，在此不再具体赘述。
训练设备220得到的目标模型/规则可以应用不同的系统或设备中。在本申请实施例中，上述目标模型/规则可以应用于船舶中通信网络或车载网络，例如，CAN。
执行设备210可以调用数据存储系统250中的数据、代码等，也可以将数据、指令等存入数据存储系统250中。可选地，上述执行设备210可以包括计算模块211、输入/输出(input/output，I/O)接口212。
I/O接口212，用于与外部设备进行数据交互，“用户”可以通过客户设备240向I/O接口212输入数据。
计算模块211使用目标模型/规则201对输入的待识别的消息数据进行处理，以确定 待识别的消息为异常消息或非异常消息。
最后，I/O接口212将处理结果返回给客户设备240，提供给用户。可选地，上述客户设备240可以是船舶中的显示装置，以提醒用户识别出异常消息。上述客户设备240还可以是车载设备中的显示装置，以提供用户识别出异常消息。
需要说明的是，训练设备220可以针对不同的目标，基于不同的数据生成相应的目标模型/规则201，以给用户提供更佳的结果。
在图1中，用户可以手动指定输入执行设备210中的数据，例如，在I/O接口212提供的界面中操作。另一种情况下，客户设备240可以自动地向I/O接口212输入数据并获得结果，如果客户设备240自动输入数据需要获得用户的授权，用户可以在客户设备240中设置相应权限。用户可以在客户设备240查看执行设备210输出的结果，具体的呈现形式可以是显示、声音、动作等具体方式。客户设备240也可以作为数据采集端将采集到消息的特征数据存入数据库230。
值得注意的，图1仅是本发明实施例提供的一种系统架构的示意图，图中所示设备、器件、模块等之间的位置关系不构成任何限制，例如，在图1中，数据存储系统250相对执行设备210是外部存储器，在其它情况下，数据存储系统250也可以将数据存储系统250置于执行设备210中。
下文结合图2介绍本申请实施例的运行异常消息识别模型的硬件设备的示意图。需要说明的是，本申请实施例中的异常消息检测模型可以通过图2所示的神经网络处理器50实现。
神经网络处理器(neural-network processing unit，NPU)50作为协处理器挂载到主中央处理器(host central processing unit，Host CPU)上，由Host CPU分配任务。NPU的核心部分为运算电路503，控制器504控制运算电路503提取存储器(权重存储器或输入存储器)中的数据并进行运算。
在一些实现中，运算电路503内部包括多个处理单元(process engine,PE)。在一些实现中，运算电路503是二维脉动阵列。运算电路503还可以是一维脉动阵列或者能够执行例如乘法和加法这样的数学运算的其它电子线路。在一些实现中，运算电路503是通用的矩阵处理器。
举例来说，假设有输入矩阵A，权重矩阵B，输出矩阵C。运算电路从权重存储器502中取矩阵B相应的数据，并缓存在运算电路中每一个PE上。运算电路从输入存储器501中取矩阵A数据与矩阵B进行矩阵运算，得到的矩阵的部分结果或最终结果，保存在累加器(accumulator)508中。
向量计算单元507可以对运算电路的输出做进一步处理，如向量乘，向量加，指数运算，对数运算，大小比较等等。例如，向量计算单元507可以用于神经网络中非卷积/非全连接层的网络计算，如池化(pooling)，批归一化(batch normalization)，局部响应归一化(local response normalization)等。
在一些实现方式中，向量计算单元507能将经处理的输出的向量存储到统一缓存器506。例如，向量计算单元507可以将非线性函数应用到运算电路503的输出，例如累加值的向量，用以生成激活值。在一些实现中，向量计算单元507生成归一化的值、合并值，或二者均有。在一些实现中，处理过的输出的向量能够用作到运算电路503的激活输入， 例如用于在神经网络中的后续层中的使用。
统一存储器506用于存放输入数据以及输出数据。
存储单元访问控制器(direct memory access controller，DMAC)505用于将外部存储器中的输入数据搬运到输入存储器501和/或统一存储器506、将外部存储器中的权重数据存入权重存储器502，以及将统一存储器506中的数据存入外部存储器。
总线接口单元(bus interface unit，BIU)51，用于通过总线实现主CPU、DMAC和取指存储器509之间进行交互。
与控制器504连接的取指存储器(instruction fetch buffer)509，用于存储控制器504使用的指令。
控制器504，用于调用指存储器509中缓存的指令，实现控制该运算加速器的工作过程。
一般地，统一存储器506，输入存储器501，权重存储器502以及取指存储器509均为片上(On-Chip)存储器，外部存储器为该NPU外部的存储器，该外部存储器可以为双倍数据率同步动态随机存储器(double data rate synchronous dynamic random access memory，DDR SDRAM)、高带宽存储器(high bandwidth memory，HBM)或其他可读可写的存储器。
上文结合图1和图2介绍了本申请实施例适用的通用架构的示意图，下文以车辆为例，结合图3介绍本申请实施例使用的场景。也就是说，图3所述的车辆300可以作为系统100中的客户设备240。图2中所示的NPU 50可以作为车辆300中安全执行单元(security enforcement units，SEU)中的一部分，或者，NPU 50可以充当SEU的角色，实现SEU对应的功能。
图3是本申请实施例适用的车辆300的功能框图。图3所示的车辆300包括SEU 310、车载网络的通信总线320以及功能子系统330。
SEU 310，用于对车载网络中传输的消息进行监控，例如，基于异常消息识别模型，识别车载网络中的传输的消息，以确定车载网络中是否存在异常消息。
上述SEU 310可以连接至车载网络的通信总线320，可以监视通过通信总线320的消息，以检测上述异常消息(又称“异常消息”)，可选地，还可以执行针对上述异常消息相关的操作，例如，发出警告等。
需要说明的是，上述车载网络中传输的消息可以理解为，通过车载网络从第一车载设备传输至第二车载设备的消息，其中，第一车载设备和/或第二车载设备可以是车辆中的电子控制单元(electronic control unit，ECU)，或者还可以是微控制单元(microcontroller unit，MCU)等，本申请实施例对车载设备的具体形式不作限定。
车载网络的通信总线320，可以理解为车载网络中的通信干线，用来在车载网络的各个节点之间传输消息。
在本申请实施例中，上述消息可以是通过通信总线传输的任意数据格式，例如，可以是单个数据包、信号、帧等。本申请实施例对此不作具体限定。
上述车载网络的通信总线320可以是任何类型的车载网络的通信总线，本申请实施例对此不作限定。例如，上述车载网络可以是基于控制器局域网络(controller area network,CAN)的车载网络。此时，车载网络中传输的消息可以是基于CAN协议的消息，例如， 消息可以包括CAN ID以及最多8个字节的有效载荷数据。
可选地，在车载网络中，具有相同功能，或者出于相同目的发送的消息可以具有相同的标识符或标识(ID)，例如，CAN协议规定的消息中携带的CAN ID。
功能子系统330，用于实现车辆300所需的各种功能。例如，可以包括行进系统、传感器系统、控制系统等。
其中，行进系统可包括为车辆提供动力运动的组件。在一个实施例中，行进系统可包括引擎、能量源、传动装置和车轮/轮胎。传动装置可以将来自引擎的机械动力传送到车轮。传动装置可包括变速箱、差速器和驱动轴。在一个实施例中，传动装置还可以包括其他器件，比如离合器。
传感器系统可包括感测关于车辆周边的环境的信息的若干个传感器。例如，传感器系统可包括定位系统、惯性测量单元(inertial measurement unit，IMU)、雷达、激光测距仪以及相机等。传感器系统还可包括被监视车辆的内部系统的传感器(例如，车内空气质量监测器、燃油量表、机油温度表等)。来自这些传感器中的一个或多个的传感器数据可用于检测对象及其相应特性(位置、形状、方向、速度等)。这种检测和识别是自主车辆的安全操作的关键功能。
控制系统为控制车辆及其组件的操作。控制系统可包括各种元件，其中包括转向系统、油门、制动单元、传感器融合算法、计算机视觉系统、路线控制系统以及障碍物避免系统。
需要说明的是，本申请实施例的功能子系统330还可以包括转向子系统等其他子系统，为了简洁，不再一一列举。
基于现有的异常消息识别方案，在对异常消息识别模型进行训练时，仅输入两条消息之间的特征值的第一差异值(例如，到达时间间隔)，后期在基于该异常消息识别模型对异常消息进行识别时，也是基于两条消息之间的第一差异值进行的。
然而，实际情况中每两条消息都不是严格按照一个相同的第一差异值进行传输的，每两条消息之间可能对应多种第一差异值，这样，上述基于第一差异值进行训练得出的异常消息识别模型不够准确，继而也会降低基于该异常消息识别模型识别异常消息的准确度。
为了便于理解，下文以两条消息之间的特征值的第一差异值为到达时间间隔，且异常消息识别模型为深度神经网络(Deep Neural Network，DNN)为例，结合图4介绍的传统的异常消息识别方法。图4示出了传统的异常消息识别模型的示意图。
DNN 400可以理解为具有很多层隐含层120的神经网络，这里的“很多”并没有特别的度量标准，我们常说的多层神经网络和深度神经网络其本质上是同一个东西。从DNN 100按不同层的位置划分，DNN 400内部的神经网络可以分为三类：输入层410，隐含层420，输出层430。一般来说第一层是输入层410，最后一层是输出层430，中间层420的层数都是隐含层。层与层之间是全连接的，也就是说，第i层的任意一个神经元一定与第i+1层的任意一个神经元相连。虽然DNN看起来很复杂，但是就每一层的工作来说，其实并不复杂，简单来说就是如下线性关系表达式：
Figure PCTCN2020087711-appb-000001
其中，
Figure PCTCN2020087711-appb-000002
是输入向量，
Figure PCTCN2020087711-appb-000003
是输出向量，b是偏移向量，W是权重矩阵(也称系数)，α()是激活函数。每一层仅仅是对输入向量经过如此简单的操作得到输出向量。由于DNN层数多，则系数和偏移向量的数量也就是很多了。以一个L层的DNN为例，如：第l层的第j个神经元的线性系数定义为
Figure PCTCN2020087711-appb-000004
其中j＝(1,2,…，n)，L＝(1,2,…，N)，n、N为正整数。上标l代表系数w所在的 层数，而下标对应的是输出的第l层索引j和输入的第l层索引k。注意，输入层是没有参数的。在深度神经网络中，更多的隐含层让网络更能够刻画现实世界中的复杂情形。理论上而言，参数越多的模型复杂度越高，“容量”也就越大，也就意味着它能完成更复杂的学习任务。
当上述DNN作为异常消息识别模型时，输入向量
Figure PCTCN2020087711-appb-000005
包括待识别消息的有效载荷中每一位的载荷数据
Figure PCTCN2020087711-appb-000006
待识别消息的长度I len，待识别消息对应的标识I ID以及待识别消息与上一条消息之间的到达时间间隔I diff'。上述输出向量
Figure PCTCN2020087711-appb-000007
可以用于指示待识别消息为异常消息或者非异常消息。
也就是说，传统的方案中，由于车载网络中具有相同ID的消息都是周期性传输的，因此，在基于异常消息识别模型对待识别消息进行识别时，需要向异常消息识别模型输入待识别消息与上一条消息之间的I diff'，以通过I diff'与预设周期之间的差异程度，确定待识别消息为异常消息或非异常消息。
然而，在实际的消息传输过程中，具有相同ID的消息并不都是按照一个相同的周期进行传输的，具有相同ID的消息通常会对应对个不同的周期，此时，如果基于传统的方案对待识别消息进行识别，会限制异常消息识别模型的准确度。
因此，为了避免上述问题，本申请实施例提供了一种新的异常消息的识别方法，即在基于异常消息识别模型对待识别消息(下文又称“第一消息”)的过程中，向异常消息识别模型输入第一消息的特征值与第二消息的特征值之间的第一差异值所对应的差异类，其中不同的差异类对应的差异值的取值范围不同，有利于提高基于异常消息识别模型进行异常消息识别的准确度。下文结合图5介绍本申请实施例的异常消息的识别方法。
图5是本申请实施例的异常消息的识别方法示意性流程图。图5所示的方法500包括步骤510至步骤530。
510，SEU接收第一消息，并确定第一消息的特征值与第二消息的特征值之间的第一差异值，第二消息为在接收第一消息之前接收到的消息。
上述第一消息的特征值与第二消息的特征值用于度量消息的相同属性，例如，特征值为消息的到达时间。或者，上述第一消息的特征值与第二消息的特征值用于表示消息中作用相同的特征。例如，可以指指消息中有效载荷的值。
可选地，上述特征值可以指消息中有效载荷的值，此时，第一消息的特征值与第二消息的特征值之间的第一差异值，可以理解为，第一消息中有效载荷的值与第二消息中有效载荷的值之间的第一差异值。例如，第一消息用于指示将车辆的车速调整为第一车速，则第一消息可以通过第一消息中的有效载荷的值指示第一车速。第二消息用于指示将车辆的车速调整为第二车速，则第二消息可以通过第二消息中的有效载荷的值指示第二车速。上述第一差异值用于指示第一车速和第二车速之间车速的变化量。
可选地，上述特征值还可以指示消息的到达时间，此时，第一消息的特征值与第二消息的特征值之间的第一差异值，可以理解，第一消息的到达时间与第二消息的到达时间之间的时间间隔，又称第一到达时间间隔。
可选地，上述第二消息可以为第一消息的上一条消息，可以理解为，第二消息为SEU在接收第一消息之前接收到的上一条消息。也就是说，第一消息和第二消息可以为相邻的两条消息。
可选地，上述第二消息为非异常消息。这样，在后续基于第一差异值识别第一消息为异常消息或者非异常消息时，有利于提高识别第一消息的准确性。避免了由于第二消息本身为异常消息，从而导致第一差异值的异常。当然，在本申请实施例中，也可以不用确定第二消息为异常消息或非异常消息。
应理解，上述第二消息为非异常消息，且第二消息为第一消息的上一条消息，也就是说，第二消息为第一消息的上一条非异常消息。此时，第二消息可能与第一消息为相邻的消息，即第一消息的上一条消息为非异常消息，则上一条消息为第二消息。然而，如果第一消息的上一条消息为异常消息，那么第二消息为在第一消息之前发送，且与第一消息的到达时间间隔最近的一条消息。
需要说明的是，上述第二消息是否为异常消息，可以基于异常消息识别模型对第二消息进行识别后的结果确定。
520，SEU从预设的多个差异类中确定第一差异值对应的差异类，多个差异类中不同的差异类对应差异值不同的取值范围，其中差异值可以表示两条消息的特征值之间的差异程度。
上述第一差异值对应的差异类，可以理解为，该第一差异值所属的取值范围对应的差异类。例如，上述第一差异值为第一消息和第二消息之间的到达时间间隔时，上述多个差异类中不同的差异类对应到达时间间隔不同的取值范围。
图6是本申请实施例中到达时间间隔与多个差异类之间的对应关系的示意图。假设上述差异类用“类 1”表示，到达时间间隔对应的取值范围包括[0,t 1]、(t 1,t 2]、(t 2,t x]、(t x,t max]以及(t max,t ∞]。其中，[t 1,t max]为厂商规定的到达时间间隔的取值范围，或者说该范围内的到达时间间隔是非异常的。(t max,t ∞]表示位于[t 1,t max]之外的到达时间间隔的取值范围，(t max,t ∞]为到达时间间隔的异常取值范围。则[0,t 1]对应的类 1的标识为0，(t 1,t 2]对应的类 1的标识为1，(t 2,t x]对应的类 1的标识为2，(t x,t max]对应的类 1的标识为x，(t max,t ∞]对应的类 1的标识为-1。
530，SEU将第一差异值对应的差异类的标识输入预存的异常消息识别模型，以确定第一消息为异常消息或非异常消息。
上述异常消息可以理解为与异常有关的消息，可以包括基于偏离期望有效载荷值(内容值)或偏离期望时序来发送的消息。
上述基于ML的异常消息识别模型可以是基于ML的数学模型，例如，可以是DNN或者卷积神经网络等，本申请实施例上述数学模型的具体形式不作限定。
以异常消息识别模型为DNN为例，结合图7介绍本申请实施例的异常消息识别模型。需要说明的是，图7所示的模型框图与图4所示的模型结构相似，仅对输入层以及输入向量有改进，因此，为了简洁，具有相同功能的模型框架使用与图4中相同的编号，并且其具体功能下文不再赘述。
图7是本申请实施例的异常消息识别模型的示意图。图7所示的异常消息识别模型700包括输入层710，隐含层420，输出层430。向输入层710输入的输入向量
Figure PCTCN2020087711-appb-000008
可以包括上述第一差异值所属的差异类的标识I diff'，第一消息中每一位的值
Figure PCTCN2020087711-appb-000009
第一消息的长度I len，第一消息的标识I ID。
通常，在车载网络通信领域，具有相似或者相同功能的消息的消息ID相同，具有相似或者相同功能的消息之间的特征值的变化也更加规律，更加符合上文中按照多个周期传输，或者多次传输时有效载荷的值的差异不会太大。因此，本申请实施例的方案也适用于这种场景中，即第一消息和第二消息具有相同的消息ID。例如，基于CAN的通信网络中，第一消息和第二消息具有相同的CAN ID。当然，也可以对第一消息和第二消息的消息标识不作限定。
如上文所述，在识别第一消息的过程中，可以不关注第二消息是否为异常消息，但是，如果第二消息为异常消息，那么在一定程度上第二消息的特征值会影响第一消息的识别结果。为了避免这种情况，提高识别异常消息的准确性，在本申请实施例中，还可以再向异常消息识别模型输入第一消息的特征值与上一条非异常消息(又称第三消息)的特征值之间的差异程度。下文结合图6进行介绍本申请另一实施例的异常消息识别方法。
图8是本申请另一实施例的异常消息识别方法的流程图。图8所示的方法在上述方法500的基础上还包括步骤810至步骤830。
810，SEU确定第一消息的特征值与第三消息的特征值之间的第二差异值，第三消息为在接收第一消息之前接收到的非异常消息。
其中，关于上述第三消息的特征值的含义，与上文中第二消息的特征值的含义相似，请参照上文的介绍，为了简洁，在次不再赘述。
需要说明的是，当上文中第二消息为非异常消息时，第三消息与第二消息为相同的消息，则上述第二差异值与第一差异值相同。当上文的第二消息为异常消息时，第二消息与第三消息是不同的消息，则上述第二差异值与第一差异值也不相同。
可选地，上述第三消息可以为第一消息的上一条非异常消息，可以理解为，第三消息为SEU在接收第一消息之前接收到的上一条非异常消息。也就是说，第一消息和第三消息可以为相邻的两条消息，也可以为不相邻的两条消息。
820，从多个差异类中确定第二差异值对应的差异类。
如上文所述，差异类对应差异值的不同的取值范围，从多个差异类中确定第二差异值对应的差异类，可以理解为，从多个差异类中确定第二差异值所属的取值范围对应的差异类。
上述步骤530包括：830，SEU将第一差异值对应的差异类的标识，以及第二差异值对应的差异类的标识输入异常消息识别模型，以确定第一消息为异常消息或非异常消息，其中，差异类的标识用于唯一标识对应的差异类。
需要说明的是，当上述第一差异值和第二差异值相同时，上述第一差异值对应的差异类的标识与第二差异值对应的差异类的标识相同。当上述第一差异值和第二差异值不同时，上述第一差异值对应的差异类的标识与第二差异值对应的差异类的标识可能相同也可能不同。
以异常消息识别模型为DNN为例，结合图8介绍本申请实施例的异常消息识别模型。需要说明的是，图9所示的模型框图与图7所示的模型结构相似，仅对输入层以及输入向量有改进，因此，为了简洁，具有相同功能的模型框架使用与图7中相同的编号，并且其具体功能下文不再赘述。
图9是本申请另一实施例的异常消息识别模型的示意图。图9所示的异常消息识别模 型900包括输入层910，隐含层420，输出层430。向输入层910输入的输入向量
Figure PCTCN2020087711-appb-000010
可以包括上述第一差异值对应的差异类的标识I diff'，第二差异值对应的差异类的标识I honest-diff'，第一消息中每一位的值
Figure PCTCN2020087711-appb-000011
第一消息的长度I len，第一消息的标识I ID。
通常，在车载网络通信领域，具有相似或者相同功能的消息的消息ID相同，具有相似或者相同功能的消息之间的特征值的变化也更加规律，更加符合上文中按照多个周期传输，或者多次传输时有效载荷的值的差异不会太大。因此，本申请实施例的方案也适用于这种场景中，即第一消息、第二消息以及第三消息具有相同的消息ID。例如，基于CAN的通信网络中，第一消息、第二消息以及第三消息具有相同的CAN ID。当然，也可以对第一消息、第二消息以及第三消息的消息标识不作限定。
上文结合图5至图9介绍了本申请基于异常消息识别模型对第一消息是否为异常消息进行推理的过程。下文结合图10至图12介绍异常消息识别模型的训练过程。需要说明的是，训练过程中与上述推理过程中，代表相同含义的特征使用相同的术语，例如，特征值。为了简洁，下文不再具体赘述。
下文中涉及的训练过程可以由上文中的SEU执行，也可以由云端实现，本申请实施例对此不作限定。当训练过程由SEU执行时，SEU的架构可以参见图1所示，由训练设备220对异常消息识别模型进行训练。为了便于理解，在介绍本申请实施例的异常消息识别模型的训练方法之前，下文结合图10主要介绍云端计算的架构，并以异常消息识别模型为RNN为例介绍模型的训练过程。
图10是本申请实施例提供了一种系统架构1000的示意图。执行设备1010由一个或多个服务器实现，可选的，与其它计算设备配合，例如：数据存储、路由器、负载均衡器等设备；执行设备1010可以布置在一个物理站点上，或者分布在多个物理站点上。执行设备1010可以使用数据存储系统1050中的数据，或者调用数据存储系统1050中的程序代码实现本申请实施例的异常消息识别模型的训练方法，具体地训练方法将在下文中介绍，为了简洁，在此不再赘述。
用户可以操作各自的用户设备(例如本地设备1001和本地设备1002)与执行设备1010进行交互。每个本地设备可以表示任何计算设备，例如个人计算机、计算机工作站、智能手机、平板电脑、智能汽车或其他类型蜂窝电话等。
每个用户的本地设备可以通过任何通信机制/通信标准的通信网络与执行设备1010进行交互，通信网络可以是广域网、局域网、点对点连接等方式，或它们的任意组合。
在另一种实现中，执行设备1010的一个方面或多个方面可以由每个本地设备实现，例如，本地设备1001可以为执行设备1010提供本地数据或反馈计算结果。
DNN中的每一层的工作可以用数学表达式
Figure PCTCN2020087711-appb-000012
来描述：从物理层面DNN中的每一层的工作可以理解为通过五种对输入空间(输入向量的集合)的操作，完成输入空间到输出空间的变换(即矩阵的行空间到列空间)，这五种操作包括：1、升维/降维；2、放大/缩小；3、旋转；4、平移；5、“弯曲”。其中1、2、3的操作由
Figure PCTCN2020087711-appb-000013
完成，4的操作由+b完成，5的操作则由a()来实现。这里之所以用“空间”二字来表述是因为被分类的对象并不是单个事物，而是一类事物，空间是指这类事物所有个体的集合。其中，W是权重向量，该向量中的每一个值表示该层神经网络中的一个神经元的权重值。该向量W决定着上文所述的输入空间到输出空间的空间变换，即每一层的权重W控制着如何变 换空间。训练DNN的目的，也就是最终得到训练好的神经网络的所有层的权重矩阵(由很多层的向量W形成的权重矩阵)。因此，神经网络的训练过程本质上就是学习控制空间变换的方式，更具体的就是学习权重矩阵。
因为希望DNN的输出尽可能的接近真正想要预测的值，所以可以通过比较当前网络的预测值和真正想要的目标值，再根据两者之间的差异情况来更新每一层神经网络的权重向量(当然，在第一次更新之前通常会有初始化的过程，即为DNN中的各层预先配置参数)，比如，如果网络的预测值高了，就调整权重向量让它预测低一些，不断的调整，直到神经网络能够预测出真正想要的目标值。因此，就需要预先定义“如何比较预测值和目标值之间的差异”，这便是损失函数(loss function)或目标函数(objective function)，它们是用于衡量预测值和目标值的差异的重要方程。其中，以损失函数举例，损失函数的输出值(loss)越高表示差异越大，那么DNN的训练就变成了尽可能缩小这个输出值的过程。
下文将结合图11介绍本申请实施例的异常消息识别模型的训练方法。图11是本申请实施例的异常消息识别模型的训练方法的示意性流程图。图11所示的方法包括步骤1110和步骤1120。
1110，获取训练数据集，训练数据集包含N条第一训练消息，以及N条第一训练消息对应的N个第一差异值对应的N个差异类的N个标识，N个第一差异值为N条第一训练消息的特征值与对应的N条第二训练消息的特征值之间的差异值，N条第一训练消息与N条第二训练消息一一对应，N条第二训练消息为在对应的N条第一训练消息到达目标节点之前到达的消息，N个差异类中不同的差异类对应差异值不同的取值范围，其中，N为大于1的正整数。
上述目标节点为通信网络中的接收N条第一训练消息以及N条第二训练消息的节点。
N个第一差异值为N条第一训练消息中每条第一训练消息的特征值与第二训练消息的特征值之间的差异值，也就是说，每条第一训练消息都有对应的第二训练消息。
需要说明的是，通常为了提高训练数集的多样性，上述N个第一差异值可以是部分相同，以提高训练异常消息识别模型的准确性。
可选地，上述N条第一训练消息和N条第二训练消息可以具有相同的标识，例如，在CAN车载网络中，上述N条第一训练消息和N条第二训练消息可以携带相同的CAN ID。
可选地，上述N条第二训练消息可以是对应的第一训练消息的上一条消息。
可选地，上述N条第二训练消息还可以是非异常消息，以提高训练异常消息识别模型的准确度。当然，本申请实施例也可以不关注N条第二训练消息为异常消息还是非异常消息。
需要说明的是，若第二训练消息为非异常消息，且第二训练消息为第一训练消息的上一条消息时，若第一训练消息的上一条训练消息为非异常消息时，则上一条消息为第二训练消息。若第一训练消息的上一条训练消息为异常消息时，上述第二训练消息为与第一训练消息的到达时间间隔最短的非异常消息。应理解，上述说明以上述N条第二训练消息中的一条第二训练消息为例进行，其他第二训练消息也适用该说明。
1120，基于训练数据集对预存的原始异常消息识别模型进行训练，得到异常消息识别 模型，异常消息识别模型用于确定待识别消息为异常消息或非异常消息。
如上文所述，为了进一步提高训练异常消息识别模型的准确性，还可以向原始异常消息检测模型输入N个第二差异值，即N条第一训练消息的特征值与对应的N条非异常消息(又称“第三训练消息”)的特征值之间的N个差异值。
也就是说，训练数据集还包括N条第一训练消息的N个第二差异值对应的N个差异类的N个标识，N个第二差异值为N条第一训练消息的特征值与对应的N条第三训练消息的特征值之间的N个差异值，N条第一训练消息与N条第三训练消息一一对应，N条第三训练消息为在对应的第一训练消息到达目标节点之前到达的消息，且N条第三训练消息为非异常消息。
可选地，上述N条第一训练消息和N条第三训练消息可以具有相同的标识，例如，在CAN车载网络中，上述N条第一训练消息和N条第三训练消息可以携带相同的CAN ID。
可选地，上述N条第三训练消息可以是对应的第一训练消息的上一条消息。此时，上述N条第三训练消息可能是与对应的第一训练消息相邻的消息，上述N条第三训练消息也可能是与对应的第一训练消息不相邻(或者说间隔)的消息。以第一训练消息 1为例，当第一训练消息 1的上一条消息为非异常消息时，则第一训练消息 1对应的第三训练消息与第一训练消息 1相邻。当第一训练消息 1的上一条消息为异常消息时，则第一训练消息 1对应的第三训练消息与第一训练消息 1不相邻，此时，第一训练消息 1对应的第三训练消息为与第一训练消息 1的到达时间间隔最短的非异常消息。
需要说明的是，当N条第一训练消息中的某一条第一训练消息对应的上一条训练消息为非异常消息时，则与该第一训练消息对应的第二训练消息和与该第一训练消息对应的第三训练消息可以是一条训练消息，此时，该第一训练消息对应的第一差异值和该第一训练消息对应的第一差异值相同。
可选地，上述特征值可以是消息的到达时间，则N个第一差异值为N条第一训练消息与对应的N条第二训练消息之间的到达时间间隔，N个第二差异值为N条第一训练消息与对应的N条第三训练消息之间的到达时间间隔。
下文以特征值为到达时间为例，结合表1介绍了本申请实施例的训练数据集的一种可能的实现方式。表1中列出了训练数据集中6条消息对应的信息。需要说明的是，表1所示的6条消息的序号仅是为了便于说明，在实际的训练数据集中可以不存在。
表1
序号 I diff I ID I Len I P1 I P2 I P3 I P4 I P5 I P6 I P7 I P8 I honst-diff 标签
1 0 768 8 207 188 78 61 0 0 128 232 0 1
2 0 768 8 207 188 78 61 0 0 144 216 0 1
3 0 769 8 20 66 72 112 90 40 144 94 0 1
4 0 1810 8 67 127 29 195 107 214 178 228 -1 -1
5 2 768 8 207 180 78 61 0 0 160 208 2 1
6 2 913 8 72 11 0 0 100 50 16 135 2 1
消息1对应的第一差异类的标识I diff为0，对应的消息标识I ID为“768”，对应的消息长度I Len为8字节，对应的第一个字节I P1中的有效载荷为207，对应的第二个字节I P2中 的有效载荷为188，对应的第三个字节I P3中的有效载荷为78，对应的第四个字节I P4中的有效载荷为61，对应的第五个字节I P5中的有效载荷为0，对应的第六个字节I P6中的有效载荷为0，对应的第七个字节I P7中的有效载荷为128，对应的第八个字节I P8中的有效载荷为232，对应的第二差异类的标识I honst-diff为0，对应的标签(label)为1，表示消息1为非异常消息。
消息2对应的第一差异类的标识I diff为0，对应的消息标识I ID为“768”，对应的消息长度I Len为8字节，对应的第一个字节I P1中的有效载荷为207，对应的第二个字节I P2中的有效载荷为188，对应的第三个字节I P3中的有效载荷为78，对应的第四个字节I P4中的有效载荷为61，对应的第五个字节I P5中的有效载荷为0，对应的第六个字节I P6中的有效载荷为0，对应的第七个字节I P7中的有效载荷为144，对应的第八个字节I P8中的有效载荷为216，对应的第二差异类的标识I honst-diff为0，对应的标签为1，表示消息2为非异常消息。
消息3对应的第一差异类的标识I diff为0，对应的消息标识I ID为“769”，对应的消息长度I Len为8字节，对应的第一个字节I P1中的有效载荷为20，对应的第二个字节I P2中的有效载荷为66，对应的第三个字节I P3中的有效载荷为72，对应的第四个字节I P4中的有效载荷为112，对应的第五个字节I P5中的有效载荷为90，对应的第六个字节I P6中的有效载荷为40，对应的第七个字节I P7中的有效载荷为144，对应的第八个字节I P8中的有效载荷为94，对应的第二差异类的标识I honst-diff为0，对应的标签为1，表示消息3为非异常消息。
消息4对应的第一差异类的标识I diff为0，对应的消息标识I ID为“769”，对应的消息长度I Len为8字节，对应的第一个字节I P1中的有效载荷为67，对应的第二个字节I P2中的有效载荷为127，对应的第三个字节I P3中的有效载荷为29，对应的第四个字节I P4中的有效载荷为195，对应的第五个字节I P5中的有效载荷为107，对应的第六个字节I P6中的有效载荷为214，对应的第七个字节I P7中的有效载荷为178，对应的第八个字节I P8中的有效载荷为228，对应的第二差异类的标识I honst-diff为-1，对应的标签为-1，表示消息4为异常消息。
消息5对应的第一差异类的标识I diff为0，对应的消息标识I ID为“768”，对应的消息长度I Len为8字节，对应的第一个字节I P1中的有效载荷为207，对应的第二个字节I P2中的有效载荷为180，对应的第三个字节I P3中的有效载荷为78，对应的第四个字节I P4中的有效载荷为61，对应的第五个字节I P5中的有效载荷为0，对应的第六个字节I P6中的有效载荷为0，对应的第七个字节I P7中的有效载荷为160，对应的第八个字节I P8中的有效载荷为208，对应的第二差异类的标识I honst-diff为2，对应的标签为1，表示消息5为非异常消息。
消息6对应的第一差异类的标识I diff为0，对应的消息标识I ID为“913”，对应的消息长度I Len为8字节，对应的第一个字节I P1中的有效载荷为72，对应的第二个字节I P2中的有效载荷为11，对应的第三个字节I P3中的有效载荷为0，对应的第四个字节I P4中的有效载荷为0，对应的第五个字节I P5中的有效载荷为100，对应的第六个字节I P6中的有效载荷为50，对应的第七个字节I P7中的有效载荷为16，对应的第八个字节I P8中的有效载荷为135，对应的第二差异类的标识I honst-diff为2，对应的标签为1，表示消息6为非异常消 息。
在实际获取训练数据时，直接得到的可能是两条消息的特征值之间的差异值(例如，第一差异值和/或第二差异值)，因此，在将差异值映射到差异类得到例如上述表1所示的训练数据集之前，需要基于差异值可能的取值范围进行差异类的划分，使得不同的差异类对应差异值不同的取值范围。即在步骤1110之前，上述方法还包括：步骤1130至步骤1150。图12示出了本申请另一实施例的异常消息识别模型的训练方法的示意性流程图。
1130，确定多条第一训练消息对应的目标差异值的最大值和特征值的最小值。
上述目标差异值可以是上文中的第一差异值也可以是上文中的第二差异值。
上述多条第一训练消息可以是上述训练数据集中包括的N条第一训练消息，也可以是与上述训练数据集中包括的N条第一训练消息无关的第一训练消息，本申请实施例对此不作具体限定。
1140，根据最大值和最小值确定目标差异值的第一取值范围。
可以将上述最大值作为取值范围的上限，将上述最小值作为取值范围的下限，以将取值范围的上限与取值范围的下限之间的连续区间作为取值范围。
1150，将目标差异值的第一取值范围划分为不重叠的多个取值范围，每个目标差异值的取值范围对应一个差异类。
上述多个取值范围中不同的取值范围对应不同的差异类，最终，多个取值范围对应的多个差异类即为上文中的N个差异类。
需要说明的是，上述第一取值范围划分为不重叠的多个取值范围的方法有很多种，例如，可以基于Jenks自然断点算法将第一取值范围划分为多个取值范围。该方法旨在确定将目标差异值划分到不同差异类中的最佳配置，因此，该方法减小了差异类内的差异并使差异类间的差异最大化，基于Jenks自然断点算法划分出的差异类又称Jenks类。又例如，可以直接上述第一取值范围划分为大小相等的间隔，因此，划分出的差异类又称线性类。又例如，还可以将第一取值范围划分为包含同等数量的训练消息的多个间隔。
在上述取值范围划分完成后，可以将N条第一训练消息对应的第一差异值和/或第二差异值进行差异类区间的映射，即步骤1160，将N条第一训练消息对应的N个第一差异值和/或N个第二差异值映射到对应的差异类，以确定N个第一差异值对应的差异类标识，和/或N个第二差异值对应的差异类标识。也就是说，上述步骤1130至步骤1160可以理解为在对原始异常消息识别模型进行训练之前的准备过程。
下文以特征值为到达时间，表1为训练数据集为例，介绍从表2到表1的生成过程，即上文的“准备过程”。表2示出了本申请实施例的数据集的一种可能的实现方式。需要说明的是，表2与表1中含义相同的参数使用的标识相同，为了简洁，下文不再具体赘述。另外，表2所示的6条消息的序号也仅是为了便于说明，在实际的训练数据集中可以不存在。
表2
Figure PCTCN2020087711-appb-000014
Figure PCTCN2020087711-appb-000015
消息1对应的第一差异值t diff为0，对应的第二差异值t honst-diff为0。消息2对应的第一差异值t diff为0.014914，对应的第二差异值t honst-diff为0.014914。消息3对应的第一差异值t diff为0.014706，对应的第二差异值t honst-diff为0.014706。消息4对应的第一差异值t diff为0，对应的第二差异值t honst-diff为0。消息5对应的第一差异值t diff为0.020089，对应的第二差异值t honst-diff为0.020089。消息6对应的第一差异值t diff为0.049258，对应的第二差异值t honst-diff为0.049258。
假设将取值范围和差异类的对应完成后，消息标识为768的消息可以对应5个差异类，其中，差异类 0对应的取值范围为[0.0,0.01752499999997781]，差异类 1对应的取值范围为(0.01752499999997781,0.019290000000182772]，差异类 2对应的取值范围为(0.019290000000182772,0.020568000000366737]，差异类 3对应的取值范围为(0.020568000000366737,0.022227000000043518]，差异类 4对应的取值范围为(0.022227000000043518,0.02717000000001235]。
消息标识为769的消息可以对应5个差异类，其中，差异类 0对应的取值范围为[0.0,0.01753699999999725]，差异类 1对应的取值范围为(0.01753699999999725,0.019297000000278786]，差异类 2对应的取值范围为(0.019297000000278786,0.020578000000227803]，差异类 3对应的取值范围为(0.020578000000227803,0.022238000000015745]，差异类 4对应的取值范围为(0.022238000000015745,0.027170999999995615]。
消息标识为913的消息可以对应5个差异类，其中，差异类 0对应的取值范围为[0.0,0.047295999999732885]，差异类 1对应的取值范围为(0.047295999999732885,0.04900800000001482]，差异类 2对应的取值范围为(0.04900800000001482,0.05000099999998042]，差异类 3对应的取值范围为(0.05000099999998042,0.05100100000004204]，差异类 4对应的取值范围为(0.05100100000004204,0.052717999999913445]。
因此，消息1的消息标识为“768”，对应的第一差异值t diff为0属于差异类 0对应的取值范围[0.0,0.01752499999997781]，则对应的第一差异类的标识I diff为0，如表1所示。消息1对应的第二差异值t honst-diff为0也属于差异类 0对应的取值范围[0.0,0.01752499999997781]，则对应的第二差异类的标识I honst-diff为0，如表1所示。
消息2的消息标识为“768”，对应的第一差异值t diff为0.014914属于差异类 0对应的取值范围[0.0,0.01752499999997781]，则对应的第一差异类的标识I diff为0，如表1所示。消息2对应的第二差异值t honst-diff为0.014914也属于差异类 0对应的取值范围[0.0,0.01752499999997781]，则对应的第二差异类的标识I honst-diff为0，如表1所示。
消息3的消息标识为“769”，对应的第一差异值t diff为0属于差异类 0对应的取值范围[0.0,0.01753699999999725]，则对应的第一差异类的标识I diff为0，如表1所示。消息3 对应的第二差异值t honst-diff为0也属于差异类 0对应的取值范围[0.0,0.01753699999999725]，则对应的第二差异类的标识I honst-diff为0，如表1所示。
消息4的消息标识为“769”，对应的第一差异值t diff为0属于差异类 0对应的取值范围[0.0,0.01753699999999725]，则对应的第一差异类的标识I diff为0，如表1所示。消息4对应的第二差异值t honst-diff为0也属于差异类 0对应的取值范围[0.0,0.01753699999999725]，则对应的第二差异类的标识I honst-diff为0，如表1所示。
消息5的消息标识为“768”，对应的第一差异值t diff为0.020089属于差异类 2对应的取值范围(0.019290000000182772,0.020568000000366737]，则对应的第一差异类的标识I diff为2，如表1所示。消息5对应的第二差异值t honst-diff为0.020089也属于差异类 2对应的取值范围(0.019290000000182772,0.020568000000366737]，则对应的第二差异类的标识I honst-diff为2，如表1所示。
消息6的消息标识为“913”，对应的第一差异值t diff为0.049258属于差异类 2对应的取值范围(0.04900800000001482,0.05000099999998042]，则对应的第一差异类的标识I diff为2，如表1所示。消息6对应的第二差异值t honst-diff为0.049258也属于差异类 2对应的取值范围(0.04900800000001482,0.05000099999998042]，则对应的第二差异类的标识I honst-diff为2，如表1所示。
综上，完成了将表2所示的到达时间间隔与差异类的映射过程。
需要说明的是，假设上述用于映射第一差异值的N个差异类(又称第一差异类)，上述用于映射第二差异值的N个差异类(又称第二差异类)，则第一差异类和第二差异类可以是同一个差异类，也可以是不同的差异类。
也就是说，上述第一差异类和第二差异类可以分别确定，其确定的具体过程可以参见上文所述，为了简洁不再具体赘述。
需要说明的是，上述准备过程除了图12所示的方法外，还可以由厂家直接配置，例如，由厂家将每个ID对应的多个到达时间间隔作为上述多个差异类对应的取值范围。本申请实施例对此不作具体限定。
以上结合准备过程、训练过程以及推理过程介绍了申请实施例的异常消息识别方法，本申请实施例的方法相对于传统的异常消息识别方法而言，准确度较高。下文结合表3和4介绍针对本申请实施例的方案在不同场景下的关于准确率的仿真结果。其中，表3示出了本申请实施例的方法应用于伪装攻击(camouflage)评估时的准确率。表4示出了本申请实施例的方法应用于随机磁盘操作系统(disk operating system，DOS)攻击时的准确率。
需要说明的是，表3和表4的仿真结果是基于特征值为到达时间，每种消息ID对应6种差异类，这6种差异类中包含一个差异类用于对应异常消息的差异值的取值范围。
在下文所示的表3和表4中分别基于真正类(True Positives，TP)、假正类/误报(False Positives，FP)、真负类(True Negative，TN)、假负类/漏报(False，Negative FN)以及准确率(Accuracy)5个方面展示本申请实施例的方案与传统的方案之间的比较结果。其中，TP表示使用异常消息识别模型进行识别的过程中，消息被预测为正类且消息为正类的次数。FP表示使用异常消息识别模型进行识别的过程中，消息被预测为负类且消息为正类的次数。TN表示使用异常消息识别模型进行识别的过程中，消息被预测为负类且消息为负类的次数。FN表示使用异常消息识别模型进行识别的过程中，消息被预测为负 类且消息为正类的次数。
需要说明的是，上述负类用于指示消息为异常消息，上述正类用于指示消息为非异常消息。
表3
Figure PCTCN2020087711-appb-000016
Figure PCTCN2020087711-appb-000017
表3中示出了采用本申请实施例的识别伪装攻击的方法的准确率为测试C3至C6的准确率，分别为：99.60、99.61、99.33、99.99。传统的识别伪装攻击的方法的准确率为测试C1和C2的准确率，分别为：98.37、99.52。如表3所示，测试C3至C6的准确率高于测试C1和C2的准确率。
表4
Figure PCTCN2020087711-appb-000018
Figure PCTCN2020087711-appb-000019
表4中示出了采用本申请实施例的识别随机DOS攻击的方法的准确率为测试R3至R6的准确率，分别为99.95、99.89、98.21以及99.94。传统的识别随机DOS攻击的方法的准确率为测试R1和R2的准确率，分别为97.81和99.90。如表4所示，测试R3至R6的准确率普遍高于测试R1和R2的准确率。
上文结合图1至图12介绍了本申请实施例的异常消息的识别方法，下文结合图13至图15介绍本申请实施例的装置。应理解，需要说明的是，图13至图15所示的装置可以实现上述方法中各个步骤，为了简洁，在此不再赘述。
图13是本申请实施例的异常消息的识别装置的示意图。图13所示的装置1300包括：接收单元1310和处理单元1320。
接收单元1310，用于接收第一消息，并确定所述第一消息的特征值与第二消息的特征值之间的第一差异值，所述第二消息为在接收所述第一消息之前接收到的消息；
处理单元1320，用于从预设的多个差异类中确定所述第一差异值对应的差异类，所述多个差异类中不同的差异类对应差异值的不同的取值范围；
所述处理单元1320，还用于将所述第一差异值对应的差异类的标识输入预存的异常消息识别模型，以确定所述第一消息为异常消息或非异常消息。
可选地，所述特征值为消息的到达时间，所述第一差异值为所述第一消息的到达时间与所述第二消息的到达时间之间的到达时间间隔。
可选地，所述处理单元1320还用于：确定所述第一消息的特征值与第三消息的特征值之间的第二差异值，所述第三消息为在接收所述第一消息之前接收到的非异常消息；从所述多个差异类中确定所述第二差异值对应的差异类；将所述第一差异值对应的差异类的标识，以及所述第二差异值对应的差异类的标识输入所述异常消息识别模型，以确定所述第一消息为异常消息或非异常消息。
可选地，所述特征值为消息的到达时间，所述第二差异值为所述第一消息的到达时间与所述第三消息的到达时间之间的到达时间间隔。
可选地，所述第二消息为非异常消息。
可选地，所述多个差异类中不同的差异类对应差异值的不同的取值范围属于预设的多个取值范围，所述预设的多个取值范围是基于自然断点算法(例如，Jenks自然断点算法)，对所述特征值的第一取值范围进行划分得到的，所述第一取值范围的上限为所述异常消息识别模型的训练数据集中所述特征值对应的最大值，所述第一取值范围的下限为所述数据 集中所述特征值对应的最小值。
可选地，所述处理单元还用于：确定所述第一消息的特征信息，所述第一消息的特征信息包括所述第一消息的有效载荷中每个字节对应的载荷数据的，所述第一消息的长度或所述第一消息的消息标识中的一种或多种；将所述第一差异值对应的差异类的标识以及所述第一消息的特征信息，输入所述异常消息识别模型。
图14是本申请实施例的异常消息识别模型的训练装置的示意图。图14所示的装置包括：获取单元1410和处理单元1420。
获取单元1410用于获取训练数据集，所述训练数据集包含N条第一训练消息，以及N条第一训练消息的N个第一差异值对应的N个差异类的N个标识，所述N个第一差异值为所述N条第一训练消息的特征值与对应的N条第二训练消息的特征值之间的差异值，所述N条第一训练消息与所述N条第二训练消息一一对应，所述N条第二训练消息为在对应的所述N条第一训练消息到达目标节点之前到达的消息，所述N个差异类中不同的差异类对应差异值不同的取值范围，其中，N为大于1的正整数。
所述处理单元1420用于基于所述训练数据集对预存的原始异常消息识别模型进行训练，得到异常消息识别模型，所述异常消息识别模型用于确定待识别消息为异常消息或非异常消息。
可选地，所述训练数据集还包括所述N条第一训练消息的N个第二差异值对应的N个差异类的N个标识，所述N个第二差异值为所述N条第一训练消息的特征值与对应的N条第三训练消息的特征值之间的N个差异值，所述N条第一训练消息与所述N条第三训练消息一一对应，所述N条第三训练消息为在对应的第一训练消息到达所述目标节点之前到达的消息，且所述N条第三训练消息为非异常消息。
可选地，所述特征值为消息的到达时间，所述N个第一差异值为所述N条第一训练消息与对应的N条第二训练消息之间的到达时间间隔，所述N个第二差异值所述N条第一训练消息与对应的N条第三训练消息之间的到达时间间隔。
可选地，所述处理单元1420还用于：确定所述多条训练消息的特征值的最大值和所述特征值的最小值；根据所述最大值和所述最小值确定所述特征值的取值范围；将所述特征值的取值范围划分为不重叠的多个子范围，每个子范围对应一个第一差异类。
在可选的实施例中，所述接收单元1310可以为计算设备1500的输入/输出接口1530，所述处理单元1320可以为计算设备1500的处理器1520，计算设备1500还可以包括存储器1510，具体如图15所示。
在可选的实施例中，所述获取单元1410可以为计算设备1500的输入/输出接口1530，所述处理单元1520可以为计算设备1500的处理器1520，所述计算设备1500还可以包括存储器1510，具体如图15所示。
图15是本申请另一实施例的计算设备的示意图。图15所示的计算设备1500可以包括：存储器1510、处理器1520、输入/输出接口1530。其中，存储器1515、处理器1520和输入/输出接口1530通过内部连接通路相连，该存储器1515用于存储指令，该处理器1520用于执行该存储器1520存储的指令，以控制输入/输出接口1530接收输入的数据和信息，输出操作结果等数据。
在实现过程中，上述方法的各步骤可以通过处理器1520中的硬件的集成逻辑电路或 者软件形式的指令完成。结合本申请实施例所公开的异常消息的识别方法和/或异常消息识别模型的训练方法可以直接体现为硬件处理器执行完成，或者用处理器中的硬件及软件模块组合执行完成。软件模块可以位于随机存储器，闪存、只读存储器，可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器1510，处理器1520读取存储器1510中的信息，结合其硬件完成上述方法的步骤。为避免重复，这里不再详细描述。
应理解，本申请实施例中，该处理器可以为中央处理单元(central processing unit，CPU)，该处理器还可以是其他通用处理器、数字信号处理器(digital signal processor，DSP)、专用集成电路(application specific integrated circuit，ASIC)、现成可编程门阵列(field programmable gate array，FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件等。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。
应理解，本申请实施例中，该存储器可以包括只读存储器和随机存取存储器，并向处理器提供指令和数据。处理器的一部分还可以包括非易失性随机存取存储器。例如，处理器还可以存储设备类型的信息。
应理解，在本申请实施例中，“与A相应的B”表示B与A相关联，根据A可以确定B。但还应理解，根据A确定B并不意味着仅仅根据A确定B，还可以根据A和/或其它信息确定B。
应理解，本文中术语“和/或”，仅仅是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。另外，本文中字符“/”，一般表示前后关联对象是一种“或”的关系。
应理解，在本申请的各种实施例中，上述各过程的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本申请实施例的实施过程构成任何限定。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算 机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(Digital Subscriber Line，DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够读取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，数字通用光盘(Digital Video Disc，DVD))或者半导体介质(例如，固态硬盘(Solid State Disk，SSD))等。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求的保护范围为准。

Claims (18)

  1. 一种异常消息的识别方法，其特征在于，包括：
    安全执行单元SEU接收第一消息，并确定所述第一消息的特征值与第二消息的特征值之间的第一差异值，所述第二消息为在接收所述第一消息之前接收到的消息；
    所述SEU从预设的多个差异类中确定所述第一差异值对应的差异类，所述多个差异类中不同的差异类对应差异值的不同的取值范围；
    所述SEU将所述第一差异值对应的差异类的标识输入预存的异常消息识别模型，以确定所述第一消息为异常消息或非异常消息。
  2. 如权利要求1所述的方法，其特征在于，所述特征值为消息的到达时间，所述第一差异值为所述第一消息的到达时间与所述第二消息的到达时间之间的到达时间间隔。
  3. 如权利要求1或2所述的方法，其特征在于，所述方法还包括：
    所述SEU确定所述第一消息的特征值与第三消息的特征值之间的第二差异值，所述第三消息为在接收所述第一消息之前接收到的非异常消息；
    所述SEU从所述多个差异类中确定所述第二差异值对应的差异类；
    所述SEU将所述第一差异值对应的差异类的标识输入预存的异常消息识别模型，以确定所述第一消息为异常消息或非异常消息，包括：
    所述SEU将所述第一差异值对应的差异类的标识，以及所述第二差异值对应的差异类的标识输入所述异常消息识别模型，以确定所述第一消息为异常消息或非异常消息。
  4. 如权利要求3所述的方法，其特征在于，所述特征值为消息的到达时间，所述第二差异值为所述第一消息的到达时间与所述第三消息的到达时间之间的到达时间间隔。
  5. 如权利要求3或4所述的方法，其特征在于，所述第一消息的消息标识、所述第二消息的消息标识以及所述第三消息的消息标识相同。
  6. 如权利要求1或2所述的方法，其特征在于，所述第二消息为非异常消息。
  7. 如权利要求1-6中任一项所述的方法，其特征在于，所述多个差异类中不同的差异类对应差异值的不同的取值范围属于预设的多个取值范围，所述预设的多个取值范围是基于自然断点算法，对所述特征值的第一取值范围进行划分得到的，所述第一取值范围的上限为所述异常消息识别模型的训练数据集中所述特征值对应的最大值，所述第一取值范围的下限为所述数据集中所述特征值对应的最小值。
  8. 如权利要求1-7中任一项所述的方法，其特征在于，所述方法还包括：
    所述SEU确定所述第一消息的特征信息，所述第一消息的特征信息包括所述第一消息的有效载荷中每个字节对应的载荷数据，所述第一消息的长度或所述第一消息的消息标识中的一种或多种；
    所述SEU将所述第一差异值对应的差异类的标识输入预存的异常消息识别模型，包括：
    所述SEU将所述第一差异值对应的差异类的标识以及所述第一消息的特征信息，输入所述异常消息识别模型。
  9. 一种异常消息的识别装置，其特征在于，包括：
    接收单元，用于接收第一消息，并确定所述第一消息的特征值与第二消息的特征值之间的第一差异值，所述第二消息为在接收所述第一消息之前接收到的消息；
    处理单元，用于从预设的多个差异类中确定所述第一差异值对应的差异类，所述多个差异类中不同的差异类对应差异值的不同的取值范围；
    所述处理单元，还用于将所述第一差异值对应的差异类的标识输入预存的异常消息识别模型，以确定所述第一消息为异常消息或非异常消息。
  10. 如权利要求9所述的装置，其特征在于，所述特征值为消息的到达时间，所述第一差异值为所述第一消息的到达时间与所述第二消息的到达时间之间的到达时间间隔。
  11. 如权利要求9或10所述的装置，其特征在于，所述处理单元还用于：
    确定所述第一消息的特征值与第三消息的特征值之间的第二差异值，所述第三消息为在接收所述第一消息之前接收到的非异常消息；
    从所述多个差异类中确定所述第二差异值对应的差异类；
    将所述第一差异值对应的差异类的标识，以及所述第二差异值对应的差异类的标识输入所述异常消息识别模型，以确定所述第一消息为异常消息或非异常消息。
  12. 如权利要求11所述的装置，其特征在于，所述特征值为消息的到达时间，所述第二差异值为所述第一消息的到达时间与所述第三消息的到达时间之间的到达时间间隔。
  13. 如权利要求11或12所述的装置，其特征在于，所述第一消息的消息标识、所述第二消息的消息标识以及所述第三消息的消息标识相同。
  14. 如权利要求9或10所述的装置，其特征在于，所述第二消息为非异常消息。
  15. 如权利要求9-14中任一项所述的装置，其特征在于，所述多个差异类中不同的差异类对应差异值的不同的取值范围属于预设的多个取值范围，所述预设的多个取值范围是基于自然断点算法，对所述特征值的第一取值范围进行划分得到的，所述第一取值范围的上限为所述异常消息识别模型的训练数据集中所述特征值对应的最大值，所述第一取值范围的下限为所述数据集中所述特征值对应的最小值。
  16. 如权利要求9-15中任一项所述的装置，其特征在于，所述处理单元还用于：
    确定所述第一消息的特征信息，所述第一消息的特征信息包括所述第一消息的有效载荷中每个字节对应的载荷数据，所述第一消息的长度或所述第一消息的消息标识中的一种或多种；
    将所述第一差异值对应的差异类的标识以及所述第一消息的特征信息，输入所述异常消息识别模型。
  17. 一种计算设备，其特征在于，包括：包括至少一个处理器和存储器，所述至少一个处理器与所述存储器耦合，用于读取并执行所述存储器中的指令，以执行如权利要求1-8中任一项所述的方法。
  18. 一种计算机可读介质，其特征在于，所述计算机可读介质存储有程序代码，当所述计算机程序代码在计算机上运行时，使得计算机执行如权利要1-8中任一项所述的方法。
PCT/CN2020/087711 2020-04-29 2020-04-29 异常消息的识别方法和装置 WO2021217477A1 (zh)

Priority Applications (3)

Application Number Priority Date Filing Date Title
EP20933299.8A EP3979590A4 (en) 2020-04-29 2020-04-29 METHOD AND DEVICE FOR IDENTIFYING ABNORMAL MESSAGES
CN202080005391.XA CN112805187B (zh) 2020-04-29 2020-04-29 异常消息的识别方法和装置
PCT/CN2020/087711 WO2021217477A1 (zh) 2020-04-29 2020-04-29 异常消息的识别方法和装置

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2020/087711 WO2021217477A1 (zh) 2020-04-29 2020-04-29 异常消息的识别方法和装置

Publications (1)

Publication Number Publication Date
WO2021217477A1 true WO2021217477A1 (zh) 2021-11-04

Family

ID=75809302

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/087711 WO2021217477A1 (zh) 2020-04-29 2020-04-29 异常消息的识别方法和装置

Country Status (3)

Country Link
EP (1) EP3979590A4 (zh)
CN (1) CN112805187B (zh)
WO (1) WO2021217477A1 (zh)

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20160315958A1 (en) * 2015-04-23 2016-10-27 International Business Machines Corporation Monitoring device monitoring network
CN106170953A (zh) * 2014-04-17 2016-11-30 松下电器（美国）知识产权公司 车载网络系统、不正常检测电子控制单元以及不正常检测方法
US20160381068A1 (en) * 2015-06-29 2016-12-29 Argus Cyber Security Ltd. System and method for time based anomaly detection in an in-vehicle communication network
US20170163669A1 (en) * 2015-12-08 2017-06-08 Vmware, Inc. Methods and systems to detect anomalies in computer system behavior based on log-file sampling
US10419268B2 (en) * 2017-01-27 2019-09-17 Bmc Software, Inc. Automated scoring of unstructured events in information technology environments
CN110865626A (zh) * 2018-08-27 2020-03-06 李尔公司 用于检测消息注入异常的方法和系统

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP6839963B2 (ja) * 2016-01-08 2021-03-10 パナソニック インテレクチュアル プロパティ コーポレーション オブ アメリカＰａｎａｓｏｎｉｃ Ｉｎｔｅｌｌｅｃｔｕａｌ Ｐｒｏｐｅｒｔｙ Ｃｏｒｐｏｒａｔｉｏｎ ｏｆ Ａｍｅｒｉｃａ 異常検知方法、異常検知装置及び異常検知システム
JP6684690B2 (ja) * 2016-01-08 2020-04-22 パナソニック インテレクチュアル プロパティ コーポレーション オブ アメリカＰａｎａｓｏｎｉｃ Ｉｎｔｅｌｌｅｃｔｕａｌ Ｐｒｏｐｅｒｔｙ Ｃｏｒｐｏｒａｔｉｏｎ ｏｆ Ａｍｅｒｉｃａ 不正検知方法、監視電子制御ユニット及び車載ネットワークシステム
JP6846991B2 (ja) * 2016-07-05 2021-03-24 パナソニック インテレクチュアル プロパティ コーポレーション オブ アメリカＰａｎａｓｏｎｉｃ Ｉｎｔｅｌｌｅｃｔｕａｌ Ｐｒｏｐｅｒｔｙ Ｃｏｒｐｏｒａｔｉｏｎ ｏｆ Ａｍｅｒｉｃａ 異常検知電子制御ユニット、車載ネットワークシステム及び異常検知方法
CN110546921B (zh) * 2018-03-29 2022-10-28 松下电器（美国）知识产权公司 不正当检测方法、不正当检测装置以及程序
CN109902832B (zh) * 2018-11-28 2023-11-17 华为技术有限公司 机器学习模型的训练方法、异常预测方法及相关装置

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106170953A (zh) * 2014-04-17 2016-11-30 松下电器（美国）知识产权公司 车载网络系统、不正常检测电子控制单元以及不正常检测方法
US20160315958A1 (en) * 2015-04-23 2016-10-27 International Business Machines Corporation Monitoring device monitoring network
US20160381068A1 (en) * 2015-06-29 2016-12-29 Argus Cyber Security Ltd. System and method for time based anomaly detection in an in-vehicle communication network
US20170163669A1 (en) * 2015-12-08 2017-06-08 Vmware, Inc. Methods and systems to detect anomalies in computer system behavior based on log-file sampling
US10419268B2 (en) * 2017-01-27 2019-09-17 Bmc Software, Inc. Automated scoring of unstructured events in information technology environments
CN110865626A (zh) * 2018-08-27 2020-03-06 李尔公司 用于检测消息注入异常的方法和系统

Also Published As

Publication number Publication date
EP3979590A4 (en) 2022-07-27
EP3979590A1 (en) 2022-04-06
CN112805187A (zh) 2021-05-14
CN112805187B (zh) 2022-07-22

Similar Documents

Publication Publication Date Title
Liu et al. An intrusion detection method for internet of things based on suppressed fuzzy clustering
Wang et al. Enhanced generative adversarial network for extremely imbalanced fault diagnosis of rotating machine
WO2021212496A1 (zh) 一种电池检测的方法和装置
US20190051015A1 (en) Post-incident management for autonomous vehicles
CN109936568B (zh) 一种基于循环神经网络的防恶意攻击传感器数据采集方法
US20240005646A1 (en) Method for generating saliency map, and method and apparatus for detecting abnormal object
US20230168985A1 (en) System and method for integration testing
WO2023011172A1 (zh) 一种驾驶行为确定方法及其相关设备
CN112446462B (zh) 目标神经网络模型的生成方法和装置
CN114584522B (zh) 一种物联网设备的识别方法、系统、介质及终端
Cheng et al. DESC-IDS: Towards an efficient real-time automotive intrusion detection system based on deep evolving stream clustering
Trouli et al. Automotive virtual in-sensor analytics for securing vehicular communication
Hoang et al. Supervised contrastive ResNet and transfer learning for the in-vehicle intrusion detection system
WO2021217477A1 (zh) 异常消息的识别方法和装置
Nagarajan et al. Machine Learning based intrusion detection systems for connected autonomous vehicles: A survey
Alsulami et al. Security strategy for autonomous vehicle cyber-physical systems using transfer learning
US20180293510A1 (en) Flexible and self-adaptive classification of received audio measurements in a network environment
CN110138751B (zh) 抵御位置数据中毒攻击的车联网位置数据处理方法和装置
Jiang et al. A Complete Information Detection Method for Vehicle CAN Network Gateway Based on Neural Network
Boumiza et al. In-Vehicle Network Intrusion Detection Using DNN with ReLU Activation Function
Jedh Using messages precedence similarity to detect message injection in in-vehicle network
US20230409422A1 (en) Systems and Methods for Anomaly Detection in Multi-Modal Data Streams
US20240037480A1 (en) System and method for detecting significant change points in timeseries chart
Zhao et al. A Hybrid Few-Shot Learning Based Intrusion Detection Method for Internet of Vehicles
Ji et al. An Effective Abnormal Behavior Detection Approach for In-Vehicle Networks Using Feature Selection and Classification Algorithm

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20933299

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2020933299

Country of ref document: EP

Effective date: 20211229

NENP Non-entry into the national phase

Ref country code: DE