CN-121997183-A - Vehicle-mounted anomaly comprehensive detection method and system based on evidence deep learning

CN121997183ACN 121997183 ACN121997183 ACN 121997183ACN-121997183-A

Abstract

The invention relates to the technical field of automobile electronic safety, in particular to a vehicle-mounted anomaly comprehensive detection method and system based on evidence deep learning. The evidence deep learning model comprises four layers of core structures. The feature input layer receives information entropy of the vehicle-mounted CAN message sequence, the evidence reasoning layer internally sets model parameters, maps input features into basic probability distribution corresponding to a plurality of categories, the uncertainty calculation layer quantifies uncertainty measurement in the classifying process, and the decision output layer fuses the basic probability distribution and the uncertainty measurement result and outputs the classifying result. The training stage adopts a loss function formed by multiplying a multi-layer perceptron evidence function by a preset coefficient and an uncertainty measurement, the verification stage increases an optimal annealing factor to carry out weight adjustment on the basis of the training stage loss function, and the optimal annealing factor is determined by maximizing the correct classification on a verification set and the sample duty ratio of which the uncertainty is lower than an annealing threshold value, so that the classification precision is effectively improved.

Inventors

LONG JIANCHENG
DING XIN
ZHAO XIAOMIN
XU CAN

Assignees

合肥工业大学

Dates

Publication Date: 20260508
Application Date: 20260409

Claims (10)

1. An evidence deep learning model for uncertainty classification, comprising: The feature input layer is used for receiving an input feature vector, wherein the input feature vector is the information entropy H ID of the vehicle-mounted CAN network message sequence; the evidence reasoning layer is connected to the feature input layer and comprises a model parameter theta and is used for mapping the input feature vector into basic probability distribution of K categories; The uncertainty calculation layer is connected to the evidence reasoning layer and is used for calculating an uncertainty metric U (H ID ),U(H ID ) =1-max (m (A)) according to the basic probability distribution, A is a focus element, m (A) is the basic probability distribution, and max (m (A)) is the maximum basic probability distribution value; the decision output layer is connected to the evidence reasoning layer and the uncertainty calculation layer and is used for outputting classification results; The loss function of the model training phase L entropy and the loss function representation of the verification phase L cal are respectively: ; ; ; Wherein f (·; θ) is a multi-layer perceptron evidence function, α is a preset coefficient, β is an optimal annealing factor, N acc_det (β ') is the number of samples correctly classified by the model and having an uncertainty below a preset annealing threshold when the candidate factor β' is used on the validation set, N total is the number of validation lumped samples, argmax (·) represents the maximization solution.
2. The evidence deep learning model for uncertainty classification of claim 1, wherein the value of the optimal annealing factor β is determined by grid searching candidate factor β' over a validation set, the search interval being [0.1,2.0], the search step being 0.1.
3. The training method of the evidence deep learning model is characterized by comprising the following training steps of: s1, acquiring a vehicle-mounted CAN network message sequence data set marked with network state categories, and dividing the vehicle-mounted CAN network message sequence data set into a training set and a verification set; s2, calculating information entropy of each message sequence in the data set, and taking the information entropy as an input feature vector; S3, inputting the input feature vector into the evidence deep learning model for uncertainty classification according to claim 1 or 2, wherein the evidence deep learning model for uncertainty classification sequentially comprises the following steps: the feature input layer receives input feature vectors; the evidence reasoning layer maps the input feature vector into basic probability distribution of K network state categories; the uncertainty calculation module calculates uncertainty measurement according to the basic probability distribution, and feeds back the basic probability distribution and the uncertainty measurement to the training process; And S4, performing preliminary training on the model through the L entropy by using a training set, and then optimizing the preliminarily trained model through the L cal by using a verification set to obtain optimal model parameters and determining an optimal model.
4. The whole vehicle network intrusion detection method based on evidence deep learning is characterized by comprising the following detection steps: The method comprises the steps of acquiring a vehicle-mounted CAN network message sequence in real time, dividing the vehicle-mounted CAN network message sequence according to a preset time window, calculating the information entropy of the message sequence in each time window, and taking the information entropy as a network intrusion characteristic vector in the current time window; Inputting the network intrusion feature vector into an evidence deep learning model for uncertainty classification according to claim 1 or 2, or into an evidence deep learning model trained by the training method of an evidence deep learning model according to claim 3; And judging that network intrusion occurs when the uncertainty degree is higher than a set measurement threshold and the peak-valley difference of the uncertainty degree exceeds a set change dynamic threshold through the classification result output by the evidence deep learning model and the corresponding uncertainty degree.
5. The vehicle network intrusion detection method based on evidence deep learning according to claim 4, wherein the measurement threshold is 0.3, and the variation dynamic threshold is twice the uncertainty measurement standard deviation of the first B continuous time windows of the current time window; And when the uncertainty measure is less than or equal to 0.3, directly judging the network intrusion type according to the classification result.
6. The method for judging the faults of the whole vehicle electronic and electric appliances based on evidence deep learning is characterized by comprising the following judging steps of: Collecting an operation time domain current signal of the whole vehicle electronic and electric system in real time, and carrying out trending treatment on the operation time domain current signal to obtain a residual current signal sequence; simultaneously, receiving an optimal annealing factor in the detection process of the whole vehicle network intrusion detection method based on evidence deep learning according to claim 4 or 5; And when T new is greater than DTW, combining the abnormal judgment of the local frequency domain characteristic coefficient to confirm the physical fault of the whole vehicle electronic and electric system.
7. The method for judging the faults of the whole vehicle electronic and electric appliances based on the evidence deep learning as claimed in claim 6, characterized in that the trend removal processing is carried out on the running time domain current signal through a Savitzky-Golay filter, and the trend estimated value of the running time domain current signal at the moment t is obtained by calculation Simultaneously press The residual current signal sequence is calculated, r (t) is the residual current signal at the moment t, and x actual (t) is the operation time domain current signal actually collected at the moment t.
8. The method for judging the faults of the whole vehicle electronic and electric appliances based on evidence deep learning as claimed in claim 7, wherein the calculation formula of the dynamic time warping distance DTW is as follows: ; Wherein r 1 and r 2 are respectively two residual current signal sequences to be compared, r 1 (i) represents the value of r 1 at the moment i, r 2 (j) represents the value of r 2 at the moment j, pi is an optimal curved path, the residual current signal sequence length of which the bandwidth of the constraint Sakoe-Chiba is +/-10% is composed of a series of pairs (i, j) and represents a rule for matching corresponding points of the two sequences, d (r 1 (i),r 2 (j)) is Euclidean distance between r 1 (i) and r 2 (j), min is the minimum value of all pi, and DTW (r 1 ,r 2 ) is the dynamic time warping distance between r 1 and r 2 .
9. The method for judging the faults of the whole vehicle electronic and electric appliance based on the evidence deep learning, which is characterized in that after the physical faults of the whole vehicle electronic and electric appliance system are determined, probability distribution of fault types is output through a neural network; setting a probability judgment threshold value to be 0.7; if the probability value of the fault type corresponding to the maximum probability value in the probability distribution is greater than or equal to 0.7, outputting the fault type; if the maximum probability value is less than 0.7, an uncertainty warning is output.
10. The utility model provides a whole car electronic and electric safety comprehensive detection system which characterized in that includes: The data acquisition unit is used for synchronously acquiring the vehicle-mounted CAN network message sequence and the operation signal of the whole vehicle electronic and electric system, so as to ensure that the sampling synchronization error is less than 10ms; The signal enhancement and feature extraction unit is used for carrying out time domain smoothing and frequency domain logarithmic enhancement processing on the operation signal, calculating an information entropy H ID corresponding to the vehicle-mounted CAN network message sequence, carrying out continuous wavelet transformation on the operation signal to extract a local frequency domain feature coefficient, and calculating a residual current signal sequence and a dynamic time warping distance DTW through a Savitzky-Golay filter; The network intrusion detection unit is used for executing the whole vehicle network intrusion detection method based on evidence deep learning according to claim 4 or 5, outputting an intrusion judgment result, uncertainty measurement and optimal annealing factor beta, and simultaneously receiving characteristic data fed back by the physical fault judgment unit, and optimizing basic probability allocation and uncertainty estimation; The physical fault judging unit is used for executing the vehicle electronic and electric appliance fault judging method based on evidence deep learning according to any one of claims 6-9, receiving the operation signals of the data acquisition unit, the local frequency domain characteristic coefficients of the signal enhancement and characteristic extraction unit, the residual current signal sequence and the dynamic time warping distance, receiving the optimal annealing factor beta transmitted by the network intrusion detecting unit to calibrate the dynamic judging threshold T new , carrying out probability distribution output and identification on the fault type through the neural network, and feeding back the local frequency domain characteristic coefficients and the residual signal validity to the network intrusion detecting unit; The result fusion unit is used for fusing the output results of the network intrusion detection unit and the physical fault judgment unit through a weighted voting mechanism and generating a final detection report containing abnormal types, subclasses, occurrence time windows, confidence levels, position estimation and maintenance suggestions; The network intrusion detection unit is in communication connection with the physical fault judgment unit, so that bidirectional closed loop cooperation of optimal annealing factor beta transmission and characteristic data feedback is realized.

Description

Vehicle-mounted anomaly comprehensive detection method and system based on evidence deep learning Technical Field The invention relates to the technical field of automobile electronic safety, in particular to a vehicle-mounted anomaly comprehensive detection method and system based on evidence deep learning. Background Along with acceleration of the electronic and intelligent processes of the automobile, the complexity of the whole automobile electronic and electric system and the vehicle-mounted CAN bus network is continuously improved, the safety risk caused by physical faults and network intrusion is increasingly prominent, and high-precision and strong-robustness uncertainty classification and detection technology is needed to support safe operation of the automobile. In the field of uncertainty classification models, classification schemes based on combination of evidence theory and deep learning exist, the models generally have basic structures such as feature input, evidence reasoning, uncertainty calculation, result output and the like, the problem of classification is processed by extracting specific scene features, constructing an evidence extraction model and quantifying uncertainty, for example, patent application CN202311683616.9 takes the load length and byte sequence of network flow as input, calculates uncertainty values based on Dirichlet distribution, and completes classification of known and unknown flow by combining an evidence theory related loss function, but when a vehicle CAN network safety detection scene is oriented, the models have significant limitations that input features are not designed aiming at vehicle CAN network communication characteristics, general network flow features are focused, key intrusion features such as CAN message sequence information entropy are not precisely locked, feature extraction is not targeted, uncertainty measurement calculation is not uniformly standardized and defined, different models are large in calculation logic difference, classification confidence quantification is inaccurate, a loss function is not fused into a dynamically adjusted annealing factor, and only the weight is adjusted by fixed parameters, data distribution difference under a vehicle complex working condition is difficult to adapt, and uncertainty cannot be effectively restrained. Therefore, the core problem of the technology is that the targeted adaptation to the vehicle-mounted CAN network safety detection scene is lacking, a complete scheme of a fitting scene is not formed from the input feature type selection, uncertainty quantization standard to loss function optimization, and finally the accurate classification of vehicle-mounted network abnormality cannot be realized. Disclosure of Invention The invention provides an evidence deep learning model for uncertainty classification, which aims to solve the technical problem that the detection precision is low due to the fact that the existing classification model based on the evidence theory and deep learning is not suitable for a vehicle-mounted CAN network safety detection scene. Based on the evidence deep learning model, the invention further sequentially provides a training method of the evidence deep learning model, a whole vehicle network intrusion detection method based on evidence deep learning, a whole vehicle electronic and electric appliance fault judgment method based on evidence deep learning and a whole vehicle electronic and electric appliance safety comprehensive detection system. In order to achieve the above purpose, the present invention provides the following technical solutions: an evidence deep learning model for uncertainty classification, comprising: The feature input layer is used for receiving an input feature vector, wherein the input feature vector is the information entropy H ID of the vehicle-mounted CAN network message sequence; the evidence reasoning layer is connected to the feature input layer and comprises a model parameter theta and is used for mapping the input feature vector into basic probability distribution of K categories; The uncertainty calculation layer is connected to the evidence reasoning layer and is used for calculating an uncertainty metric U (H ID),U(HID) =1-max (m (A)) according to the basic probability distribution, A is a focus element, m (A) is the basic probability distribution, and max (m (A)) is the maximum basic probability distribution value; the decision output layer is connected to the evidence reasoning layer and the uncertainty calculation layer and is used for outputting classification results; The loss function of the model training phase L entropy and the loss function representation of the verification phase L cal are respectively: ; ; ; Wherein f (·; θ) is a multi-layer perceptron evidence function, α is a preset coefficient, β is an optimal annealing factor, N acc_det (β ') is the number of samples correctly classified by the model and having an uncertainty