Patent Description:
As a vehicle becomes electric, an electronic control system, a sensor, an actuator, an electronic control unit (electronic control unit, ECU), and a communications interface that are supported by a vehicle-mounted communications network continuously increase, so that the vehicle-mounted communications network and a component that performs communication by using a communications system are increasingly vulnerable to attacks, for example, network attacks, hacker attacks, or interference with an in-vehicle network. This may endanger vehicle safety and performance. As the foregoing electronic control system in the vehicle gets increasingly complex, difficulty in identifying and detecting an abnormal message between components in the vehicle is increased.

At present, an intrusion detection system (intrusion detection system, IDS) is usually used to identify the abnormal message in the vehicle. The IDS is a network security device that monitors network transmission in real time and generates an alarm or takes a proactive response measure when detecting suspicious transmission. The IDS is mainly implemented based on machine learning (machine learning, ML). In other words, an abnormal message identification model is trained according to a machine learning-based method, and information transmitted in the vehicle is identified by using the abnormal message identification model that is obtained through training, so as to improve information transmission security.

Based on an existing abnormal message identification solution, when the abnormal message identification model is trained, only a difference value (for example, an arrival time interval) between respective feature values of two messages is input. Subsequently, the abnormal message is identified based on the abnormal message identification model, as well as based on the difference value between the respective feature values of the two messages. However, in an actual case, every two messages are not transmitted strictly based on a difference value, and every two messages may correspond to a plurality of difference values. In this way, the abnormal message identification model obtained through training based on the difference value is not accurate enough. Consequently, accuracy of identifying the abnormal message based on the abnormal message identification model is reduced. <CIT> provides a method for providing security to a network, which includes maintaining a timing model of an expected behavior of data communications over the in-vehicle communication network; receiving a message sent over the network; determining based on the model and based on a timing attribute of the message, whether or not the message complies with the model; and if the message does not comply with the model then performing at least one action related to the message.

This application provides a method, an apparatus and a computer-readable medium for identifying an abnormal message.

According to a first aspect, a method for identifying an abnormal message is provided according to claim <NUM>.

In this embodiment of this application, a value range corresponding to the difference value between the feature values of the two messages is divided into the plurality of difference classes, and the identifier of the difference class corresponding to the first difference value in the plurality of difference classes is input into the abnormal message identification model, to determine whether the first message is the abnormal message or the non-abnormal message. Therefore, inputting only the difference value (for example, an arrival time interval) between the feature values of the two messages into the abnormal message identification model, as a practice in the conventional technology, is avoided. This helps improve accuracy of identifying an abnormal message based on the abnormal message identification model.

Optionally, the second message is a non-abnormal message. This helps prevent the feature value of the second message from being abnormal because the second message is an abnormal message and affecting the first difference value, and helps improve accuracy of identifying an abnormal message based on the abnormal message identification model.

In a possible implementation, the feature value is an arrival time of a message, and the first difference value is an arrival time interval between an arrival time of the first message and an arrival time of the second message.

In this embodiment of this application, a value range corresponding to the arrival time interval between the arrival times of the two messages is divided into the plurality of difference classes, and the identifier of the difference class that corresponds to the arrival time interval between the arrival time of the first message and the arrival time of the second message and that is in the plurality of difference classes is input into the abnormal message identification model, to determine whether the first message is an abnormal message or a non-abnormal message. This helps improve accuracy of identifying an abnormal message based on the abnormal message identification model.

In a possible implementation, the method further includes: the SEU determines a second difference value between the feature value of the first message and a feature value of a third message, where the third message is a non-abnormal message that is received before the first message is received; and the SEU determines, from the plurality of difference classes, a difference class corresponding to the second difference value. That the SEU inputs an identifier of the difference class corresponding to the first difference value into a pre-stored abnormal message identification model, to determine whether the first message is an abnormal message or a non-abnormal message includes: The SEU inputs, into the abnormal message identification model, the identifier of the difference class corresponding to the first difference value and an identifier of the difference class corresponding to the second difference value, to determine whether the first message is an abnormal message or a non-abnormal message.

In this embodiment of this application, the second difference value between the feature value of the first message and the feature value of the third message is determined, and the identifier of the difference class corresponding to the second difference value and the identifier of the difference class corresponding to the first difference value are input into the abnormal message identification model. This helps improve accuracy of identifying an abnormal message based on the abnormal message identification model.

In a possible implementation, the feature value is an arrival time of the message, and the second difference value is an arrival time interval between an arrival time of the first message and an arrival time of the third message.

In this embodiment of this application, the arrival time interval between the arrival time of the first message and the arrival time of the third message is determined, and the identifier of the difference class corresponding to the arrival time interval between the arrival time of the first message and the arrival time of the third message and the identifier of the difference class corresponding to the arrival time interval between the arrival time of the first message and the arrival time of the second message are input into the abnormal message identification model. This helps improve accuracy of identifying an abnormal message based on the abnormal message identification model.

In a possible implementation, the different value ranges of the difference values corresponding to the different difference classes in the plurality of difference classes belong to a plurality of preset value ranges, the plurality of preset value ranges are obtained by dividing, according to a natural breakpoint algorithm, a first value range of the feature value, an upper limit of the first value range is a maximum value corresponding to the feature value in a training data set of the abnormal message identification model, and a lower limit of the first value range is a minimum value corresponding to the feature value in the data set.

In this embodiment of this application, the first value range corresponding to the feature value is divided into the plurality of value ranges according to the natural breakpoint algorithm, to correspond to the different difference classes. This helps improve reasonableness of division of the plurality of value ranges.

In a possible implementation, the SEU determines feature information of the first message, where the feature information of the first message includes one or more of payload data corresponding to each byte in a valid payload of the first message, a length of the first message, or the message identifier of the first message. That the SEU inputs an identifier of the difference class corresponding to the first difference value into a pre-stored abnormal message identification model includes: the SEU inputs the identifier of the difference class corresponding to the first difference value and the feature information of the first message into the abnormal message identification model.

In this embodiment of this application, the identifier of the difference class corresponding to the first difference value and the feature information of the first message are input into the abnormal message identification model, to help improve accuracy of identifying the abnormal message based on the abnormal message identification model.

An example of a method for training an abnormal message identification model is provided, including: obtaining a training data set, where the training data set includes N first training messages and N identifiers of N difference classes corresponding to N first difference values of the N first training messages, the N first difference values are difference values between feature values of the N first training messages and feature values of corresponding N second training messages, the N first training messages are in a one-to-one correspondence with the N second training messages, the N second training messages are messages that arrive at a target node before the corresponding N first training messages arrive at the target node, different difference classes in the N difference classes correspond to different value ranges of the difference values, and N is a positive integer greater than <NUM>; and training a pre-stored original abnormal message identification model based on the training data set, to obtain an abnormal message identification model, where the abnormal message identification model is used to determine whether a to-be-identified message is an abnormal message or a non-abnormal message.

In this example, the N identifiers of the N difference classes corresponding to the N first difference values of the N first training messages are used as the training data set, and the original abnormal message identification model is trained based on the training data set. This avoids the following case in the conventional technology: The original abnormal message identification model is trained directly based on a difference value (for example, an arrival time interval) between feature values of two messages. This helps improve accuracy of identifying the abnormal message based on the abnormal message identification model.

Optionally, the feature values of the N first training messages may be arrival times at which the N first training messages arrive at the target node, the feature values of the N second training messages may be arrival times at which the N second training messages arrive at the target node, and the N first difference values of the N first training messages may be arrival time intervals between the arrival times at which the N first training messages arrive at the target node and the arrival times at which the N second training messages arrive at the target node.

In this example, the N identifiers of the N difference classes corresponding to the N first difference values of the N first training messages are used as training data in the training data set, and the original abnormal message identification model is trained based on the training data set. This avoids the following case in the conventional technology: the original abnormal message identification model is trained directly based on a difference value (for example, an arrival time interval) between feature values of two messages. This helps improve accuracy of identifying the abnormal message based on the abnormal message identification model.

Optionally, at least some of the N second training messages are the non-abnormal messages. This helps prevent the feature value of the second message from being abnormal because the second message is the abnormal message and affecting the first difference value, and helps improve accuracy of identifying the abnormal message based on the abnormal message identification model.

In a possible implementation, the training data set further includes N identifiers of N difference classes corresponding to N second difference values of the N first training messages, the N second difference values are N difference values between the feature values of the N first training messages and feature values of corresponding N third training messages, the N first training messages are in a one-to-one correspondence with the N third training messages, the N third training messages are messages that arrive at a target node before the corresponding first training messages arrive at the target node, and the N third training messages are the non-abnormal messages.

In this example, the N identifiers of the N difference classes corresponding to the N second difference values of the N first training messages are used as the training data set. The N third training messages are non-abnormal messages, and the original abnormal message identification model is trained based on the training data set. This helps improve accuracy of identifying an abnormal message based on the abnormal message identification model.

Optionally, the feature values of the N first training messages may be arrival times at which the N first training messages arrive at the target node, the feature values of the N third training messages may be arrival times at which the N third training messages arrive at the target node, and the N second difference values of the N first training messages may be arrival time intervals between the arrival times at which the N first training messages at the target node and the arrival times at which the N third training messages arrive at the target node.

In this example, the N identifiers of the N difference classes corresponding to the N second difference values of the N first training messages are used as training data in the training data set, and the original abnormal message identification model is trained based on the training data set. This avoids the following case in the conventional technology: The original abnormal message identification model is trained directly based on a difference value (for example, an arrival time interval) between feature values of two messages. This helps improve accuracy of identifying an abnormal message based on the abnormal message identification model.

In a possible implementation, before the training a pre-stored original abnormal message identification model based on the training data set, to obtain an abnormal message identification model, the method further includes: determining a maximum value of the feature values of the plurality of training messages and a minimum value of the feature values; determining a value range of the feature value based on the maximum value and the minimum value; and dividing the value range of the feature value into a plurality of non-overlapping sub-ranges, where each sub-range corresponds to one first difference class.

In this example, the value range of the feature values is determined based on the maximum value of the feature values of the plurality of training messages and the minimum value of the feature values, the value range of the feature values is divided into the plurality of non-overlapping sub-ranges, and each sub-range corresponds to one first difference class. In other words, a general method for determining a plurality of difference classes is provided, to expand an application scenario of this embodiment of this application.

According to a further aspect, an apparatus for identifying an abnormal message is provided. The apparatus includes units configured to perform any one of the first aspect or the possible implementations of the first aspect.

According to a further aspect, a computer program product is provided. The computer program product includes computer program codes, and when the computer program codes are run on a computer, the computer is caused to perform the methods in the foregoing aspects.

For ease of understanding, the following describes, with reference to <FIG>, a schematic diagram of a system architecture to which an abnormal message identification model is applied according to an embodiment of this application. The system <NUM> shown in <FIG> includes an execution device <NUM>, a training device <NUM>, a database <NUM>, a client device <NUM>, a data storage system <NUM>, and a data collection device <NUM>.

The data collection device <NUM> is configured to collect feature data of a message and store the feature data into the database <NUM>. The training device <NUM> generates a target model/rule <NUM> (namely, the abnormal message identification model described above) based on training data maintained in the database <NUM>. The following describes in more detail how the training device <NUM> obtains the target model/rule <NUM> based on the training data, so that the target model/rule <NUM> can identify an abnormal message.

It should be noted that, for a training process of the foregoing abnormal message identification model, refer to a method shown in the following description. For brevity, details are not described herein again.

The target model/rule obtained by the training device <NUM> may be applied to different systems or devices. In the embodiments of this application, the foregoing target model/rule may be applied to a communications network in a ship or an in-vehicle network, for example, a CAN.

The execution device <NUM> may invoke data, code, and the like in the data storage system <NUM>, or may store data, instructions, and the like into the data storage system <NUM>. Optionally, the execution device <NUM> may include a calculation module <NUM> and an input/output (input/output, I/O) interface <NUM>.

The I/O interface <NUM> is configured to exchange data with an external device, and the "user" may input data into the I/O interface <NUM> by using the client device <NUM>.

The calculation module <NUM> processes to-be-identified input message data by using the target model/rule <NUM>, to determine whether a to-be-identified message is the abnormal message or a non-abnormal message.

Finally, the I/O interface <NUM> returns a processing result to the client device <NUM>, and provides the processing result for the user. Optionally, the client device <NUM> may be a display apparatus in the ship, to prompt the user that the abnormal message is identified. Alternatively, the client device <NUM> may be a display apparatus in a vehicle-mounted device, to prompt the user that the abnormal message is identified.

It should be noted that the training device <NUM> may generate, for different targets, corresponding target models/rules <NUM> based on different data, so as to provide a better result for the user.

In <FIG>, the user may manually specify data to be input into the execution device <NUM>, for example, may operate in an interface provided by the I/O interface <NUM>. In another case, the client device <NUM> may automatically input data into the I/O interface <NUM> and obtain a result. If the client device <NUM> needs to obtain permission of the user for automatically inputting data, the user may set corresponding permission on the client device <NUM>. The user may view, on the client device <NUM>, a result output by the execution device <NUM>. A specific presentation form may be a specific manner, for example, display, a voice, or an action. The client device <NUM> may also be used as a data collection end to store collected feature data of a collected data into the database <NUM>.

It should be noted that, <FIG> is merely a schematic diagram of a system architecture according to an embodiment of the present invention. A position relationship between devices, components, modules, and the like shown in the figure does not constitute any limitation. For example, in <FIG>, the data storage system <NUM> is an external storage device relative to the execution device <NUM>, and in another case, the data storage system <NUM> may alternatively be disposed in the execution device <NUM>.

The following describes a schematic diagram of a hardware device on which an abnormal message identification model is run according to an embodiment of this application with reference to <FIG>. It should be noted that the abnormal message identification model in this embodiment of this application may be implemented by using a neural-network processing unit <NUM> shown in <FIG>.

The neural-network processing unit (neural-network processing unit, NPU) <NUM> is mounted to a host central processing unit (host central processing unit, Host CPU) as a co-processor, and the host CPU allocates tasks. A core part of the NPU is an operation circuit <NUM>, and a controller <NUM> controls the operation circuit <NUM> to extract data in a memory (a weight memory or an input memory) and perform an operation.

In some implementations, the operation circuit <NUM> includes a plurality of processing units (process engine, PE) inside. In some implementations, the operation circuit <NUM> is a two-dimensional systolic array. The operation circuit <NUM> may alternatively be a one-dimensional systolic array or another electronic circuit capable of performing mathematical operations such as multiplication and addition. In some implementations, the operation circuit <NUM> is a general-purpose matrix processor.

For example, it is assumed that there are an input matrix A, a weight matrix B, and an output matrix C. The operation circuit fetches data corresponding to the matrix B from a weight memory <NUM> and buffers the data in each PE of the operation circuit. The operation circuit fetches data of the matrix A from an input memory <NUM>, to perform a matrix operation on the matrix B, and stores an obtained partial result or an obtained final result of the matrix into an accumulator (accumulator) <NUM>.

A vector calculation unit <NUM> may perform further processing such as vector multiplication, vector addition, an exponent operation, a logarithm operation, or value comparison on an output of the operation circuit. For example, the vector calculation unit <NUM> may be configured to perform network calculation, such as pooling (pooling), batch normalization (batch normalization), or local response normalization (local response normalization), at a non-convolution/non-fully connected layer in a neural network.

In some implementations, the vector computation unit <NUM> can store, in a unified memory <NUM>, a processed output vector. For example, the vector calculation unit <NUM> can apply a non-linear function to the output of the operation circuit <NUM>, for example, a vector of an accumulated value, to generate an activated value. In some implementations, the vector calculation unit <NUM> generates a normalized value, a combined value, or both. In some implementations, the processed output vector can be used as an activated input to the operation circuit <NUM>, for example, for use in subsequent layers in the neural network.

The unified memory <NUM> is configured to store input data and output data.

A storage unit access controller (direct memory access controller, DMAC) <NUM> is configured to transfer input data in an external memory to the input memory <NUM> and/or the uniform memory <NUM>, stores weight data that is in the external memory into the weight memory <NUM>, and stores data that is in the uniform memory <NUM> into the external memory.

A bus interface unit (bus interface unit, BIU) <NUM> is configured to implement interaction between the host CPU, the DMAC, and an instruction fetch buffer <NUM> by using a bus.

The instruction fetch buffer (instruction fetch buffer) <NUM> connected to the controller <NUM>, configured to store an instruction used by the controller <NUM>.

The controller <NUM> is configured to invoke the instruction buffered in the instruction fetch buffer <NUM>, to control a working process of the operation accelerator.

Usually, the unified memory <NUM>, the input memory <NUM>, the weight memory <NUM>, and the instruction fetch buffer <NUM> each are an on-chip (On-Chip) memory. The external memory is a memory outside the NPU. The external memory may be a double data rate synchronous dynamic random access memory (double data rate synchronous dynamic random access memory, DDR SDRAM), a high bandwidth memory (high bandwidth memory, HBM), or another readable and writable memory.

The foregoing describes, with reference to <FIG> and <FIG>, a schematic diagram of a general architecture applicable to the embodiments of this application. The following describes, with reference to <FIG>, a scenario used in the embodiments of this application by using a vehicle as an example. In other words, a vehicle <NUM> in <FIG> may be used as the client device <NUM> in the system <NUM>. The NPU <NUM> shown in <FIG> may be used as a part of a security enforcement unit (security enforcement units, SEU) in the vehicle <NUM>, or the NPU <NUM> may be used as the SEU, to implement a function corresponding to the SEU.

<FIG> is a functional block diagram of a vehicle <NUM> to which an embodiment of this application is applicable. The vehicle <NUM> shown in <FIG> includes an SEU <NUM>, a communications bus <NUM> of an in-vehicle network, and a function subsystem <NUM>.

The SEU <NUM> is configured to monitor a message transmitted in the in-vehicle network, for example, identify, based on an abnormal message identification model, a message transmitted in the in-vehicle network, to determine whether there is an abnormal message in the in-vehicle network.

The SEU <NUM> may be connected to the communications bus <NUM> of the in-vehicle network, and may monitor a message that passes through the communications bus <NUM>, to detect the abnormal message (also referred to as an abnormal message). Optionally, The SEU <NUM> may further perform an operation related to the abnormal message, for example, send an alarm.

It should be noted that the message transmitted in the in-vehicle network may be understood as a message transmitted from a first vehicle-mounted device to a second vehicle-mounted device through the in-vehicle network. The first vehicle-mounted device and/or the second vehicle-mounted device may be electronic control units (electronic control unit, ECU) in the vehicle, or may be microcontroller units (microcontroller unit, MCU), or the like. A specific form of the vehicle-mounted device is not limited in this embodiment of this application.

The communications bus <NUM> in the in-vehicle network may be understood as a communications trunk in the in-vehicle network, and is configured to transmit a message between nodes in the in-vehicle network.

In this embodiment of this application, the message may be in any data format transmitted by using the communications bus, for example, may be a single data packet, signal, or frame. This is not specifically limited in the embodiments of this application.

The communications bus <NUM> of the in-vehicle network may be a communications bus of any type of in-vehicle network. This is not limited in this embodiment of this application. For example, the in-vehicle network may be an in-vehicle network based on a controller area network (controller area network, CAN). In this case, the message transmitted in the in-vehicle network may be a message according to a CAN protocol. For example, the message may include a CAN ID and valid payload data of a maximum of eight bytes.

Optionally, in the in-vehicle network, messages that have a same function or that are sent for a same purpose may have a same identifier or identification (ID). For example, a CAN ID is carried in the message specified in the CAN protocol.

The function subsystem <NUM> is configured to implement various functions required by the vehicle <NUM>. For example, a traveling system, a sensor system, a control system, and the like may be included.

The moving system may include a component that provides power for the vehicle to move. In an embodiment, the traveling system may include an engine, an energy source, a transmission apparatus, and a wheel/tire. The transmission apparatus can transfer mechanical power from the engine to the wheel. The transmission apparatus may include a gearbox, a differential, and a drive shaft. In an embodiment, the transmission apparatus may further include another component for example, a clutch.

The sensor system may include a plurality of sensors configured to sense and detect surrounding environment information of the vehicle. For example, the sensor system may include a positioning system, an inertial measurement unit (IMU), a radar, a laser rangefinder, a camera, and the like. The sensor system may further include sensors of an internal system of the monitored vehicle (for example, an in-vehicle air quality monitor, a fuel flow meter, and an oil temperature gauge). One or more pieces of sensor data from these sensors can be used to detect objects and corresponding features (a position, a shape, a direction, a speed, and the like) of the objects. Such detection and identification are key functions of security operations of an autonomous vehicle.

The control system controls operations of the vehicle and components of the vehicle. The control system may include various elements, including a steering system, a throttle, a braking unit, a sensor fusion algorithm, a computer vision system, a route control system, and an obstacle avoidance system.

It should be noted that the function subsystem <NUM> in this embodiment of this application may further include another subsystem, for example, a steering subsystem. For brevity, details are not described herein again.

Based on an existing abnormal message identification solution, when the abnormal message identification model is trained, only a difference value (for example, an arrival time interval) between feature values of two messages is input. When the abnormal message is identified based on the abnormal message identification model, the difference value between the feature values of the two messages is also used.

However, in an actual case, every two messages are not transmitted strictly based on the same first difference value, and every two messages may correspond to a plurality of first difference values. In this way, the abnormal message identification model obtained through training based on the first difference value is not accurate enough. Consequently, accuracy of identifying the abnormal message based on the abnormal message identification model is reduced.

For ease of understanding, the following describes a conventional method for identifying an abnormal message with reference to <FIG> by using an example in which a first difference value of feature values of two messages is an arrival time interval and an abnormal message identification model is a deep neural network (Deep Neural Network, DNN). <FIG> is a schematic diagram of a conventional abnormal message identification model.

A DNN <NUM> may be understood as a neural network having many hidden layers <NUM>. "Many" herein does not have a special measurement standard. A multi-layer neural network and a deep neural network are essentially the same thing. The DNN <NUM> is divided based on locations of different layers, and a neural network in the DNN <NUM> may be classified into three types: an input layer <NUM>, a hidden layer <NUM>, and an output layer <NUM>. Usually, a first layer is the input layer <NUM>, a last layer is the output layer <NUM>, and a middle layer <NUM> is the hidden layer. Layers are fully connected. To be specific, any neuron at an ith layer is definitely connected to any neuron at an (i+<NUM>)th layer. Although the DNN seems complex, it is not complex for each layer. Simply speaking, the DNN is the following linear relationship expression: <MAT>, where <MAT> is an input vector, <MAT> is an output vector, b is an offset vector, W is a weight matrix (also referred to as a coefficient), and α() is an activation function. Each layer simply performs such a simple operation on the input vector to obtain the output vector. Because there are a large quantity of DNN layers, there are a large quantity of coefficients and a large quantity of offset vectors. An L-layer DNN is used as an example. For example, a linear coefficient of a jth neuron at a lth layer is defined as <MAT>, where j = (<NUM>,<NUM>,•••, n), L = (<NUM>,<NUM>,•••, N), n and N are positive integers. A superscript l represents a quantity of layers at which a coefficient w is located, and a subscript corresponds to an index j at an output l layer and an index k at an input l layer. Note that the input layer has no parameters. In the deep neural network, more hidden layers make the network more capable of describing a complex case in the real world. Theoretically, a model with more parameters indicates higher complexity and a larger "capacity", and indicates that the model can be used to complete a more complex learning task.

When the DNN is used as an abnormal message identification model, the input vector <MAT> includes payload data IP<NUM>, IP<NUM>,. , IPs of each bit in a valid payload of a to-be-identified message, a length Ilen of the to-be-identified message, an identifier IID corresponding to the to-be-identified message, and an arrival time interval Idiff' between the to-be-identified message and a previous message. The output vector <MAT> may be used to indicate whether the to-be-identified message is an abnormal message or a non-abnormal message.

In other words, in a conventional solution, because messages with a same ID in an in-vehicle network are periodically transmitted, when the to-be-identified message is identified based on the abnormal message identification model, Idff' between the to-be-identified message and the previous message needs to be input into the abnormal message identification model, and the to-be-identified message is determined as the abnormal message or the non-abnormal message based on a degree of difference between Idiff' and a preset period.

However, in an actual message transmission process, not all messages with the same ID are transmitted based on a same period, and the messages with the same ID usually correspond to different periods. In this case, if the to-be-identified message is identified based on the conventional solution, accuracy of the abnormal message identification model is limited.

Therefore, to avoid the foregoing problem, an embodiment of this application provides a new method for identifying an abnormal message. To be specific, in a process of identifying a to-be-identified message (also referred to as a "first message" below) based on an abnormal message identification model, a difference class corresponding to a first difference value between a feature value of the first message and a feature value of a second message is input into the abnormal message identification model, where different difference classes correspond to different difference value ranges. This helps improve accuracy of identifying an abnormal message based on the abnormal message identification model. The following describes a method for identifying an abnormal message according to an embodiment of this application with reference to <FIG>.

<FIG> is a schematic flowchart of a method for identifying an abnormal message according to an embodiment of this application. The method <NUM> shown in <FIG> includes step <NUM> to step <NUM>.

<NUM>: An SEU receives a first message, and determines a first difference value between a feature value of the first message and a feature value of a second message, where the second message is a message that is received before the first message is received.

The feature value of the first message and the feature value of the second message are used to measure a same attribute of the messages. For example, the feature value is an arrival time of the message. Alternatively, the feature value of the first message and the feature value of the second message are used to indicate a feature that has a same function in the message, for example, may refer to a value of a valid payload in the message.

Optionally, the feature value may be the value of the valid payload in the message. In this case, the first difference value between the feature value of the first message and the feature value of the second message may be understood as a first difference value between a value of a valid payload in the first message and a value of a valid payload in the second message. For example, if the first message is used to indicate to adjust a vehicle speed of a vehicle to a first vehicle speed, the first message may indicate the first vehicle speed by using the valid payload value in the first message. If the second message is used to indicate to adjust the vehicle speed of the vehicle to a second vehicle speed, the second message may indicate the second vehicle speed by using the value of the valid payload in the second message. The first difference value is used to indicate a variation between the first vehicle speed and the second vehicle speed.

Optionally, the feature value may further indicate an arrival time of the message. In this case, the first difference value between the feature value of the first message and the feature value of the second message may be understood as a time interval between an arrival time of the first message and an arrival time of the second message, where the time interval is also referred to as a first arrival time interval.

Optionally, the second message may be a previous message of the first message. It may be understood that the second message is the previous message received by the SEU before the SEU receives the first message. In other words, the first message and the second message may be two adjacent messages.

Optionally, the second message is the non-abnormal message. In this way, when the first message is subsequently identified as the abnormal message or the non-abnormal message based on the first difference value, accuracy of identifying the first message is improved. This avoids an abnormality of the first difference value caused because the second message is the abnormal message. It is clear that, in this embodiment of this application, it may not be determined whether the second message is the abnormal message or the non-abnormal message.

It should be understood that the second message is the non-abnormal message, and the second message is the previous message of the first message. In other words, the second message is the previous non-abnormal message of the first message. In this case, the second message and the first message may be adjacent messages. In other words, the previous message of the first message is the non-abnormal message, and the previous message is the second message. However, if the previous message of the first message is the abnormal message, the second message is a message that is sent before the first message and that is closest to the arrival time of the first message.

It should be noted that whether the second message is the abnormal message may be determined based on a result of identifying the second message by using the abnormal message identification model.

<NUM>: The SEU determines, from a plurality of preset difference classes, a difference class corresponding to the first difference value, where different difference classes in the plurality of difference classes correspond to different value ranges of a difference value, and the difference values may indicate a degree of difference between feature values of two messages.

The difference class corresponding to the first difference value may be understood as a difference class corresponding to a value range to which the first difference value belongs. For example, when the first difference value is the arrival time interval between the first message and the second message, the different difference classes in the plurality of difference classes correspond to different value ranges of the arrival time interval.

<FIG> is a schematic diagram of a correspondence between an arrival time interval and a plurality of difference classes according to an embodiment of this application. If the foregoing difference class is represented by using "class <NUM>", value ranges corresponding to the arrival time interval include [<NUM>,t<NUM>], (t<NUM>,t<NUM>], (t<NUM>,tx], (tx,tmax], and (tmax,t∞]. [t<NUM>, tmax] is a value range of the arrival time interval specified by a vendor, or an arrival time interval within the range is non-abnormal. (tmax,t∞] indicates a value range of the arrival time interval that is out of [t<NUM>, tmax]. (tmax,t∞] is an abnormal value range of the arrival time interval. Therefore, an identifier of the class <NUM> corresponding to [<NUM>,t<NUM>] is <NUM>, an identifier of a class <NUM> corresponding to (t<NUM>,t<NUM>] is <NUM>, an identifier of the class <NUM> corresponding to (t<NUM>,tx] is <NUM>, an identifier of the class <NUM> corresponding to (tx,tmax] is x, and an identifier of the class <NUM> corresponding to (tmax,t∞] is -<NUM>.

<NUM>: The SEU inputs an identifier of the difference class corresponding to the first difference value into a pre-stored abnormal message identification model, to determine whether the first message is the abnormal message or the non-abnormal message.

The abnormal message may be understood as a message related to the exception, and may include a message sent based on a deviation from an expected valid payload value (a content value) or a deviation from an expected time sequence.

The ML-based abnormal message identification model may be an ML-based mathematical model, for example, may be a DNN or a convolutional neural network. A specific form of the mathematical model is not limited in this embodiment of this application.

An example in which the abnormal message identification model is the DNN is used to describe the abnormal message identification model in this embodiment of this application with reference to <FIG>. It should be noted that a model block diagram shown in <FIG> is similar to the model structure shown in <FIG>, and only the input layer and the input vector are improved. Therefore, for brevity, a model framework having a same function uses a same number as that in <FIG>, and a specific function of the model framework is not described in the following.

<FIG> is a schematic diagram of an abnormal message identification model according to an embodiment of this application. The abnormal message identification model <NUM> shown in <FIG> includes an input layer <NUM>, a hidden layer <NUM>, and an output layer <NUM>. An input vector <MAT> that is input into the input layer <NUM> may include an identifier Idiff' of a difference class to which the first difference value belongs, a value IP<NUM>, IP<NUM>,. , IPs of each bit in a first message, a length Ilen of the first message, and an identifier IID of the first message.

Generally, in the field of in-vehicle network communications, messages that have a similar function or a same function have a same message ID, and feature values of the messages that have the similar function or the same function have a more regular change. This better conforms to the foregoing description that when transmission is performed based on a plurality of periods, or when transmission is performed for a plurality of times, a difference between values of valid payloads is not too large. Therefore, the solution in this embodiment of this application is also applicable to this scenario. To be specific, the first message and the second message have a same message ID. For example, in a CAN-based communications network, the first message and the second message have a same CAN ID. It is clear that message identifiers of the first message and the second message may not be limited.

As described above, in a process of identifying the first message, whether the second message is the abnormal message may not be concerned. However, if the second message is the abnormal message, a feature value of the second message affects an identification result of the first message to some extent. To avoid this case and improve accuracy of identifying the abnormal message, in this embodiment of this application, a degree of difference between a feature value of the first message and a feature value of a previous non-abnormal message (also referred to as a third message) may be further input into the abnormal message identification model. The following describes a method for identifying an abnormal message according to another embodiment of this application with reference to <FIG>.

<FIG> is a flowchart of a method for identifying an abnormal message according to another embodiment of this application. Based on the foregoing method <NUM>, the method shown in <FIG> further includes step <NUM> to step <NUM>.

<NUM>: An SEU determines a second difference value between a feature value of a first message and a feature value of a third message, where the third message is a non-abnormal message that is received before the first message is received.

A meaning of the feature value of the third message is similar to a meaning of the feature value of the second message. Therefore, for the meaning of the feature value of the third message, refer to the foregoing descriptions. For brevity, details are not described herein again.

It should be noted that when the second message is the non-abnormal message, and the third message and the second message are a same message, the second difference value is the same as the first difference value. When the foregoing second message is an abnormal message, and the second message and the third message are different messages, the second difference value is different from the first difference value.

Optionally, the third message may be a previous non-abnormal message of the first message. It may be understood that the third message is a previous non-abnormal message received by the SEU before the SEU receives the first message. In other words, the first message and the third message may be two adjacent messages, or may be two non-adjacent messages.

<NUM>: Determine, from a plurality of difference classes, a difference class corresponding to the second difference value.

As described above, the difference classes correspond to different value ranges of the difference values, and determining, from the plurality of difference classes, the difference class corresponding to the second difference value may be understood as determining, from the plurality of difference classes, a difference class corresponding to a value range to which the second difference value belongs.

<NUM>: The SEU inputs an identifier of a difference class corresponding to the first difference value and an identifier of the difference class corresponding to the second difference value into an abnormal message identification model, to determine whether the first message is the abnormal message or the non-abnormal message, where the identifier of the difference class is used to uniquely identify the corresponding difference class.

It should be noted that when the first difference value is the same as the second difference value, the difference class identifier corresponding to the first difference value is the same as the difference class identifier corresponding to the second difference value. When the first difference value is different from the second difference value, the identifier of the difference class corresponding to the first difference value may be the same as or different from the identifier of the difference class corresponding to the second difference value.

<FIG> is a schematic diagram of an abnormal message identification model according to another embodiment of this application. The abnormal message identification model <NUM> shown in <FIG> includes an input layer <NUM>, a hidden layer <NUM>, and an output layer <NUM>. An input vector <MAT> that is input into the input layer <NUM> may include an identifier Idff' of a difference class corresponding to the first difference value, an identifier Ihonest-diff' of a difference class corresponding to the second difference value, a value IP<NUM>, IP<NUM>,. , IPs of each bit in the first message,. , a length Ilen of the first message, and an identifier IID of the first message.

Generally, in the field of in-vehicle network communications, messages that have a similar function or a same function have a same message ID, and feature values of the messages that have the similar function or the same function have a more regular change. This better conforms to the foregoing description that when transmission is performed based on a plurality of periods, or when transmission is performed for a plurality of times, a difference between values of valid payloads is not too large. Therefore, the solution in this embodiment of this application is also applicable to this scenario. To be specific, the first message, the second message, and the third message have a same message ID. For example, in a CAN-based communications network, the first message, the second message, and the third message have the same CAN ID. It is clear that message identifiers of the first message, the second message, and the third message may not be limited.

The foregoing describes, with reference to <FIG>, a process of performing, based on the abnormal message identification model, reasoning on whether the first message is the abnormal message in this application. The following describes a process of training the abnormal message identification model with reference to <FIG>. It should be noted that, in the training process and the foregoing reasoning process, a same term, for example, a feature value, is used for a feature that represents a same meaning. For brevity, details are not described below.

The training process in the following may be performed by the foregoing SEU, or may be implemented by a cloud. This is not limited in this embodiment of this application. When the training process is performed by the SEU, for an architecture of the SEU, refer to <FIG>. The training device <NUM> trains the abnormal message identification model. For ease of understanding, before a method for training an abnormal message identification model in the embodiments of this application is described, the following mainly describes a cloud computing architecture with reference to <FIG>, and describes the model training process by using an example in which the abnormal message identification model is an RNN.

<FIG> is a schematic diagram of a system architecture <NUM> according to an embodiment of this application. An execution device <NUM> is implemented by one or more servers. Optionally, the execution device <NUM> cooperates with another computing device, for example, a device such as a data storage device, a router, or a load balancer. The execution device <NUM> may be disposed on one physical site, or distributed on a plurality of physical sites. The execution device <NUM> may implement the method for training an abnormal message identification model in this embodiment of this application by using data in a data storage system <NUM> or by invoking program code in a data storage system <NUM>. A specific training method is described below. For brevity, details are not described herein again.

Users may operate respective user equipment (for example, a local device <NUM> and a local device <NUM>) to interact with the execution device <NUM>. Each local device may represent any computing device, such as a personal computer, a computer workstation, a smartphone, a tablet, a smart car, or another type of cellular phone.

The local device of each user may interact with the execution device <NUM> through a communications network of any communications mechanism/communications standard. The communications network may be a wide area network, a local area network, a point-to-point connection, or any combination thereof.

In another implementation, one or more aspects of the execution device <NUM> may be implemented by each local device. For example, the local device <NUM> may provide local data for the execution device <NUM> or feed back a computation result.

Work of each layer in the DNN may be described by using a mathematical expression: <MAT>. The work of each layer in the DNN may physically be understood as completing transformation from input space to output space (to be specific, row space to column space of a matrix) by performing five operations on the input space (a set of input vectors). The five operations include: <NUM>. dimension raising/dimension reduction, <NUM>. scaling out/scaling in, <NUM>. rotation, <NUM>. translation, and <NUM>. The operations of <NUM>, <NUM>, and <NUM> are performed by W□x, the operation of <NUM> is performed by +b, and the operation of <NUM> is performed by a(). A reason why the word "space" is used herein for description is that a classified object is not a single object, but a type of object. The space refers to a set of all individuals of this type of object. W is a weight vector, and each value in the vector represents a weight value of one neuron in a neural network at this layer. The vector W determines space transformation from the input space to the output space described above, to be specific, a weight W of each layer controls how to transform space. The DNN is trained to finally obtain a weight matrix (a weight matrix constituted by vectors W of a plurality of layers) of all layers of the trained neural network. Therefore, a process of training the neural network is essentially a manner of learning control of spatial transformation, and more specifically, learning a weight matrix.

It is desired that an output of the DNN shall be close, as much as possible, to an actually expected predicted value. Therefore, a predicted value of the current network and an actually expected target value may be compared, and then a weight vector of each layer of neural network is updated based on a difference between the two values (it is clear that there is usually an initialization process before the first update, to be specific, parameters are preconfigured for all layers of the DNN). For example, if the predicted value of the network is excessively large, the weight vector is adjusted to make the predicted value smaller. Such adjustment is continuously performed until the neural network can obtain the actually expected target value through prediction. Therefore, "how to obtain, through comparison, a difference between a predicted value and a target value" needs to be predefined. This is the loss function (loss function) or an objective function (objective function). The loss function and the objective function are important equations used to measure the difference between the predicted value and the target value. The loss function is used as an example. A higher output value (loss) of the loss function indicates a larger difference, and therefore, DNN training becomes a process of reducing the output value as much as possible.

The following describes the method for training an abnormal message identification model according to an embodiment of this application with reference to <FIG> is a schematic flowchart of a method for training an abnormal message identification model according to an embodiment of this application. The method shown in <FIG> includes a step <NUM> and a step <NUM>.

<NUM>: Obtain a training data set, where the training data set includes N first training messages and N identifiers of N difference classes corresponding to N first difference values corresponding to the N first training messages, the N first difference values are difference values between feature values of the N first training messages and feature values of corresponding N second training messages, the N first training messages are in a one-to-one correspondence with the N second training messages, the N second training messages are messages that arrive at a target node before the corresponding N first training messages arrive at the target node, different difference classes in the N difference classes correspond to different value ranges of the difference values, and N is a positive integer greater than <NUM>.

The target node is a node that is in the communications network and that receives the N first training messages and the N second training messages.

The N first difference values are difference values between a feature value of each of the N first training messages and a feature value of each of the second training messages. In other words, each first training message has a corresponding second training message.

It should be noted that, generally, to improve diversity of the training number set, the N first difference values may be partially the same, so as to improve accuracy of training the abnormal message identification model.

Optionally, the N first training messages and the N second training messages may have a same identifier. For example, in a CAN in-vehicle network, the N first training messages and the N second training messages may carry a same CAN ID.

Optionally, the N second training messages may be previous messages of the corresponding first training messages.

Optionally, the N second training messages may alternatively be non-abnormal messages, to improve accuracy of training the abnormal message identification model. It is clear that, in this embodiment of this application, whether the N second training messages are abnormal messages or the non-abnormal messages may not be considered.

It should be noted that, if the second training message is the non-abnormal message, and the second training message is the previous message of the first training message, and if the previous training message of the first training message is the non-abnormal message, the previous message is the second training message. If the previous training message of the first training message is the abnormal message, the second training message is a non-abnormal message whose arrival time interval between the second training message and the first training message is the shortest. It should be understood that the foregoing description is performed by using one of the N second training messages as an example, and the description is also applicable to another second training message.

<NUM>: Train a pre-stored original abnormal message identification model based on the training data set, to obtain an abnormal message identification model, where the abnormal message identification model is used to determine whether a to-be-identified message is the abnormal message or the non-abnormal message.

As described above, to further improve accuracy of training the abnormal message identification model, N second difference values, that is, N difference values between feature values of the N first training messages and feature values of corresponding N non-abnormal messages (also referred to as "third training messages") may be input into the original abnormal message identification model.

In other words, the training data set further includes N identifiers of N difference classes corresponding to the N second difference values of the N first training messages, and the N second difference values are the N difference values between the feature values of the N first training messages and the feature values of the corresponding N third training messages. The N first training messages are in a one-to-one correspondence with the N third training messages. The N third training messages are messages that arrive at the target node before the corresponding first training messages arrive at the target node, and the N third training messages are the non-abnormal messages.

Optionally, the N first training messages and the N third training messages may have a same identifier. For example, in a CAN in-vehicle network, the N first training messages and the N third training messages may carry a same CAN ID.

Optionally, the N third training messages may be previous messages of the corresponding first training messages. In this case, the N third training messages may be messages adjacent to the corresponding first training messages, or the N third training messages may be messages that are not adjacent (or spaced) to the corresponding first training messages. A first training message <NUM> is used as an example. When a previous message of the first training message <NUM> is the non-abnormal message, a third training message corresponding to the first training message <NUM> is adjacent to the first training message <NUM>. When the previous message of the first training message <NUM> is the abnormal message, the third training message corresponding to the first training message <NUM> is not adjacent to the first training message <NUM>. In this case, the third training message corresponding to the first training message <NUM> is a non-abnormal message whose arrival time interval between the third training message and the first training message <NUM> is the shortest.

It should be noted that when a previous training message corresponding to a first training message in the N first training messages is a non-abnormal message, a second training message corresponding to the first training message and a third training message corresponding to the first training message may be one training message. In this case, a first difference value corresponding to the first training message is the same as a second difference value corresponding to the first training message.

Optionally, the feature value may be an arrival time of a message, the N first difference values are arrival time intervals between the N first training messages and the corresponding N second training messages, and the N second difference values are arrival time intervals between the N first training messages and the corresponding N third training messages.

The following describes a possible implementation of the training dataset in this embodiment of this application with reference to Table <NUM> by using an example in which the feature value is the arrival time. Table <NUM> lists information corresponding to six messages in the training data set. It should be noted that sequence numbers of the six messages shown in Table <NUM> are merely for ease of description, and may not exist in an actual training data set.

An identity Idiff of a first difference class corresponding to the message <NUM> is <NUM>, a corresponding message identity IID is "<NUM>", a corresponding message length ILen is <NUM> bytes, a valid payload in a corresponding first byte IP1 is <NUM>, a valid payload in a corresponding second byte IP2 is <NUM>, a valid payload in a corresponding third byte IP3 is <NUM>, a valid payload in a corresponding fourth byte IP4 is <NUM>, a valid payload in a corresponding fifth byte IP5 is <NUM>, a valid payload in a corresponding sixth byte IP6 is <NUM>, a valid payload in a corresponding seventh byte IP7 is <NUM>, a valid payload in a corresponding eighth byte IP8 is <NUM>, a corresponding identifier Ihonst-diff of a second difference class is <NUM>, and a corresponding label (label) is <NUM>, which indicates that the message <NUM> is the non-abnormal message.

An identity Idiff of a first difference class corresponding to a message <NUM> is <NUM>, a corresponding message identity IID is "<NUM>", a corresponding message length ILen is <NUM> bytes, a valid payload in a corresponding first byte IP1 is <NUM>, a valid payload in a corresponding second byte IP2 is <NUM>, a valid payload in a corresponding third byte IP3 is <NUM>, a valid payload in a corresponding fourth byte IP4 is <NUM>, a valid payload in a corresponding fifth byte IP5 is <NUM>, a valid payload in a corresponding sixth byte IP6 is <NUM>, a valid payload in a corresponding seventh byte IP7 is <NUM>, a valid payload in a corresponding eighth byte IP8 is <NUM>, a corresponding identifier Ihonst-diff of a second difference class is <NUM>, and a corresponding label is <NUM>, which indicates that the message <NUM> is the non-abnormal message.

An identifier Idiff of a first difference class corresponding to a message <NUM> is <NUM>, a corresponding message identifier IID is "<NUM>", a corresponding message length ILen is <NUM> bytes, a valid payload in a corresponding first byte IP1 is <NUM>, a valid payload in a corresponding second byte IP2 is <NUM>, a valid payload in a corresponding third byte IP3 is <NUM>, a valid payload in a corresponding fourth byte IP4 is <NUM>, a valid payload in a corresponding fifth byte IP5 is <NUM>, a valid payload in a corresponding sixth byte IP6 is <NUM>, a valid payload in a corresponding seventh byte IP7 is <NUM>, a valid payload in a corresponding eighth byte IP8 is <NUM>, a corresponding identifier Ihonst-diff of a second difference class is -<NUM>, and a corresponding label is -<NUM>, which indicates that the message <NUM> is the abnormal message.

An identifier Idiff of a first difference class corresponding to a message <NUM> is <NUM>, a corresponding message identifier IID is "<NUM>", a corresponding message length ILen is <NUM> bytes, a valid payload in a corresponding first byte IP1 is <NUM>, a valid payload in a corresponding second byte IP2 is <NUM>, a valid payload in a corresponding third byte IP3 is <NUM>, a valid payload in a corresponding fourth byte IP4 is <NUM>, a valid payload of a corresponding fifth byte IP5 is <NUM>, a valid payload in a corresponding sixth byte IP6 is <NUM>, a valid payload in a corresponding seventh byte IP7 is <NUM>, a valid payload in a corresponding eighth byte IP8 is <NUM>, a corresponding identifier Ihonst-diff of a second difference class is <NUM>, and a corresponding label is <NUM>, which indicates that the message <NUM> is the non-abnormal message.

When the training data is actually obtained, a difference value (for example, the first difference value and/or the second difference value) between the feature values of the two messages may be directly obtained. Therefore, before the difference value is mapped to the difference class to obtain the training data set shown in Table <NUM>, the difference classes need to be classified based on possible value ranges of the difference values, so that different difference classes correspond to the different value ranges of the difference values. That is, before step <NUM>, the foregoing method further includes step <NUM> to step <NUM>. <FIG> is a schematic flowchart of a method for training an abnormal message identification model according to another embodiment of this application.

<NUM>: Determine a maximum value of target difference values corresponding to a plurality of first training messages and a minimum value of feature values corresponding to the plurality of first training messages.

The target difference value may be the first difference value in the foregoing description, or may be the second difference value in the foregoing description.

The plurality of first training messages may be the N first training messages included in the training data set, or may be first training messages unrelated to the N first training messages included in the training data set. This is not specifically limited in this embodiment of this application.

<NUM>: Determine a first value range of the target difference value based on the maximum value and the minimum value.

The maximum value may be used as an upper limit of the value range, the minimum value may be used as a lower limit of the value range, and a continuous interval between the upper limit of the value range and the lower limit of the value range may be used as the value range.

<NUM>: Divide the first value range of the target difference value into a plurality of non-overlapping value ranges, where each value range of the target difference value corresponds to one difference class.

Different value ranges in the plurality of value ranges correspond to different difference classes. Finally, the plurality of difference classes corresponding to the plurality of value ranges are the N difference classes in the foregoing description.

It should be noted that there are many methods for dividing the first value range into the plurality of non-overlapping value ranges. For example, the first value range may be divided into the plurality of value ranges according to a Jenks natural breakpoint algorithm. This method aims to determine optimal configuration for classifying the target difference value into the different difference classes. Therefore, this method reduces differences in the difference classes and maximizes differences between the difference classes. The difference classes divided based on the Jenks natural breakpoint algorithm are also called Jenks classes. For another example, the first value range may be directly divided into intervals of a same size. Therefore, the difference classes obtained through division are also referred to as linear classes. For another example, the first value range may be further divided into a plurality of intervals including a same quantity of training messages.

After the value range division is completed, the first difference values and/or the second difference values corresponding to the N first training messages may be mapped to difference class intervals, that is, step <NUM>: map the N first difference values and/or the N second difference values corresponding to the N first training messages to corresponding difference classes, to determine identifiers of difference classes corresponding to the N first difference values and/or identifiers of difference classes corresponding to the N second difference values. That is, the foregoing step <NUM> to step <NUM> may be understood as a preparation process before the original abnormal message identification model is trained.

The following describes a generation process, that is, the foregoing "preparation process", from Table <NUM> to Table <NUM> by using an example in which the feature value is the arrival time and Table <NUM> is the training data set. Table <NUM> shows a possible implementation of the dataset in this embodiment of this application. It should be noted that parameters with a same meaning in Table <NUM> and Table <NUM> use a same identifier. For brevity, details are not described below. In addition, sequence numbers of the six messages shown in Table <NUM> are merely for ease of description, and may not exist in an actual training data set.

A first difference value tdiff corresponding to the message <NUM> is <NUM>, and a corresponding second difference value thonst-diff is <NUM>. A first difference value tdiff corresponding to the message <NUM> is <NUM>, and a corresponding second difference value thonst-diff is <NUM>. A first difference value tdiff corresponding to the message <NUM> is <NUM>, and a corresponding second difference value thonst-diff is <NUM>. A first difference value tdiff corresponding to the message <NUM> is <NUM>, and a corresponding second difference value thonst-diff is <NUM>. A first difference value tdiff corresponding to the message <NUM> is <NUM>, and a corresponding second difference value thonst-diff is <NUM>. A first difference value tdiff corresponding to the message <NUM> is <NUM>, and a corresponding second difference value thonst-diff is <NUM>.

It is assumed that after the mapping between the value ranges and the difference classes is completed, a message whose message identifier is <NUM> may correspond to five difference classes. A value range corresponding to a difference class <NUM> is [<NUM>, <NUM>], a value range corresponding to a difference class <NUM> is (<NUM>, <NUM>] , and a value range corresponding to a difference class <NUM> is (<NUM>, <NUM>] , a value range corresponding to a difference class <NUM> is (<NUM>, <NUM>], and a value range corresponding to a difference class <NUM> is (<NUM>, <NUM>].

A message whose message identifier is <NUM> may correspond to five difference classes. A value range corresponding to a difference class <NUM> is [<NUM>, <NUM>], a value range corresponding to a difference class <NUM> is (<NUM>, <NUM>], a value range corresponding to a difference class <NUM> is (<NUM>, <NUM>], a value range corresponding to a difference class <NUM> is (<NUM>, <NUM>] , and a value range corresponding to a difference class <NUM> is (<NUM>, <NUM>].

A message whose message identifier is <NUM> may correspond to five difference classes. A value range corresponding to a difference class <NUM> is [<NUM>, <NUM>], a value range corresponding to a difference class <NUM> is (<NUM>, <NUM>], a value range corresponding to a difference class <NUM> is (<NUM>, <NUM>], a value range corresponding to a difference class <NUM> is (<NUM>, <NUM>], and a value range corresponding to a difference class <NUM> is (<NUM>, <NUM>].

Therefore, if the message identifier of the message <NUM> is "<NUM>", and the corresponding first difference value tdiff is <NUM>, which belongs to the value range [<NUM>, <NUM>] corresponding to the difference class <NUM>, the corresponding identifier Idiff of the first difference class is <NUM>, as shown in Table <NUM>. If the second difference value thonst-diff corresponding to the message <NUM> is <NUM>, which also belongs to the value range [<NUM>, <NUM>] corresponding to the difference class <NUM>, the corresponding identifier Ihonst-diff of the second difference class is <NUM>, as shown in Table <NUM>.

If the message identifier of the message <NUM> is "<NUM>", and the corresponding first difference value tdiff is <NUM>, which belongs to the value range [<NUM>, <NUM>] corresponding to the difference class <NUM>, the corresponding identifier Idiff of the first difference class is <NUM>, as shown in Table <NUM>. If the second difference value thonst-diff corresponding to the message <NUM> is <NUM>, which also belongs to the value range [<NUM>, <NUM>] corresponding to the difference class <NUM>, the corresponding identifier Ihonst-diff of the second difference class is <NUM>, as shown in Table <NUM>.

If the message identifier of the message <NUM> is "<NUM>", and the corresponding first difference value tdiff is <NUM>, which belongs to the value range (<NUM>, <NUM>] corresponding to the difference class <NUM>, the corresponding identifier Idiff of the first difference class is <NUM>, as shown in Table <NUM>. If the second difference value thonst-diff corresponding to the message <NUM> is <NUM>, which also belongs to the value range (<NUM>, <NUM>] corresponding to the difference class <NUM>, the corresponding identifier Ihonst-diff of the second difference class is <NUM>, as shown in Table <NUM>.

If the message identifier of the message <NUM> is "<NUM>", and the corresponding first difference value tdiff is <NUM>, which belongs to the value range (<NUM>, <NUM>] corresponding to the difference class <NUM>, the corresponding identifier Idiff of the first difference class is <NUM>, as shown in Table <NUM>. If the second difference value thonst-diff corresponding to the message <NUM> is <NUM>, which also belongs to the value range (<NUM>, <NUM>] corresponding to the difference class <NUM>, a corresponding identifier Ihonst-diff of a second difference class is <NUM>, as shown in Table <NUM>.

In conclusion, a process of mapping the arrival time intervals to the difference classes shown in Table <NUM> is completed.

It should be noted that if the foregoing N difference classes (also referred to as the first difference classes) are used to map the first difference values, and the foregoing N difference classes (also referred to as second difference classes) are used to map the second difference values, the first difference class and the second difference class may be a same difference class, or may be different difference classes.

In other words, the first difference class and the second difference class may be separately determined. For a specific process of determining the first difference class and the second difference class, refer to the foregoing description. For brevity, details are not described again.

It should be noted that, in addition to the method shown in <FIG>, the foregoing preparation process may also be directly configured by a vendor. For example, the vendor uses a plurality of arrival time intervals corresponding to each ID as the value ranges corresponding to the plurality of difference classes. This is not specifically limited in the embodiments of this application.

The method for identifying an abnormal message in this embodiment of this application is described above with reference to the preparation process, the training process, and the inference process. Compared with a conventional method for identifying an abnormal message, the method in this embodiment of this application has relatively high accuracy. The following describes simulation results of accuracy of the solutions in the embodiments of this application in different scenarios with reference to Table <NUM> and Table <NUM>. Table <NUM> shows accuracy when the method in this embodiment of this application is applied to camouflage (camouflage) attack evaluation. Table <NUM> shows accuracy of the method in this embodiment of this application when the method is applied to a random disk operating system (disk operating system, DOS) attack.

It should be noted that, the simulation results in Table <NUM> and Table <NUM> are based on that the feature value is the arrival time, each message ID corresponds to six difference classes, and the six difference classes include a difference class used to correspond to a value range of a difference value of an abnormal message.

Table <NUM> and Table <NUM> below are respectively based on five aspects of a true positive (True Positives, TP), a false positive/false positive (False Positives, FP), a true negative (True Negative, TN), a false negative/false negative (False Negative FN), accuracy (Accuracy) show a comparison result between the solution in this embodiment of this application and a conventional solution. TP represents a quantity of times that messages are predicted to be a positive and the messages are the positive in a process of performing identification by using the abnormal message identification model. FP indicates a quantity of times that messages are predicted to be the positive and the messages are a negative in the process of performing identification by using the abnormal message identification model. TN indicates a quantity of times that messages are predicted to be the negative and the messages are the negative in the process of performing identification by using the abnormal message identification model. FN indicates a quantity of times that messages are predicted to be the negative and the messages are the positive in the process of performing identification by using the abnormal message identification model.

It should be noted that the negative is used to indicate that the message is an abnormal message, and the positive is used to indicate that the message is a non-abnormal message.

Table <NUM> shows that accuracy obtained by using a method for identifying a camouflage attack in this embodiment of this application is accuracy obtained by testing C3 to C6, where the accuracy is respectively <NUM>, <NUM>, <NUM>, and <NUM>. Accuracy obtained by using a conventional method for identifying a camouflage attack is accuracy obtained by testing C1 and C2, where the accuracy is respectively <NUM> and <NUM>. As shown in Table <NUM>, the accuracy obtained by testing C3 to C6 is higher than the accuracy obtained by testing C1 and C2.

Table <NUM> shows that accuracy obtained by using the method for identifying a random DOS attack in this embodiment of this application is accuracy obtained by testing R3 to R6, where the accuracy is respectively <NUM>, <NUM>, <NUM>, and <NUM>. Accuracy obtained by using a conventional method for identifying a random DOS attack is accuracy obtained by testing R1 and R2, which is <NUM> and <NUM> respectively. As shown in Table <NUM>, the accuracy obtained by testing R3 to R6 is generally higher than the accuracy obtained by testing R1 and R2.

The foregoing describes the method for identifying an abnormal message in the embodiments of this application with reference to <FIG>, and the following describes apparatuses in the embodiments of this application with reference to <FIG>. It should be noted that the apparatus shown in <FIG> may implement the steps in the foregoing methods. For brevity, details are not described herein again.

<FIG> is a schematic diagram of an apparatus for identifying an abnormal message according to an embodiment of this application. The apparatus <NUM> shown in <FIG> includes a receiving unit <NUM> and a processing unit <NUM>.

The receiving unit <NUM> is configured to receive a first message, and determine a first difference value between a feature value of the first message and a feature value of a second message, where the second message is a message that is received before the first message is received.

The processing unit <NUM> is configured to determine, from a plurality of preset difference classes, a difference class corresponding to the first difference value, where different difference classes in the plurality of difference classes correspond to different value ranges of the difference value.

The processing unit <NUM> is further configured to input an identifier of the difference class corresponding to the first difference value into a pre-stored abnormal message identification model, to determine whether the first message is an abnormal message or a non-abnormal message.

Optionally, the feature value is an arrival time of the message, and the first difference value is an arrival time interval between an arrival time of the first message and an arrival time of the second message.

Optionally, the processing unit <NUM> is further configured to determine a second difference value between the feature value of the first message and a feature value of a third message, where the third message is a non-abnormal message that is received before the first message is received; determine, from the plurality of difference classes, a difference class corresponding to the second difference value; and input the identifier of the difference class corresponding to the first difference value and an identifier of the difference class corresponding to the second difference value into the abnormal message identification model, to determine whether the first message is the abnormal message or the non-abnormal message.

Optionally, the feature value is the arrival time of the message, and the second difference value is an arrival time interval between the arrival time of the first message and an arrival time of the third message.

Optionally, the second message is the non-abnormal message.

Optionally, different value ranges of difference values corresponding to the different difference classes in the plurality of difference classes belong to a plurality of preset value ranges, the plurality of preset value ranges are obtained by dividing a first value range of the feature value according to a natural breakpoint algorithm (for example, a Jenks natural breakpoint algorithm). An upper limit of the first value range is a maximum value corresponding to the feature value in a training data set of the abnormal message identification model, and a lower limit of the first value range is a minimum value corresponding to the feature value in the data set.

Optionally, the processing unit is further configured to: determine feature information of the first message, where the feature information of the first message includes one or more of payload data corresponding to each byte in a valid payload of the first message, a length of the first message, or a message identifier of the first message; and input the identifier of the difference class corresponding to the first difference value and the feature information of the first message into the abnormal message identification model.

<FIG> is a schematic diagram of an apparatus for training an abnormal message identification model according to an embodiment of this application. The apparatus shown in <FIG> includes an obtaining unit <NUM> and a processing unit <NUM>.

The obtaining unit <NUM> is configured to obtain a training data set, where the training data set includes N first training messages and N identifiers of N difference classes corresponding to N first difference values of the N first training messages. The N first difference values are difference values between feature values of the N first training messages and feature values of corresponding N second training messages. The N first training messages are in a one-to-one correspondence with the N second training messages. The N second training messages are messages that arrive at a target node before the corresponding N first training messages arrive at the target node, different difference classes in the N difference classes correspond to different value ranges of the difference values, and N is a positive integer greater than <NUM>.

The processing unit <NUM> is configured to train a pre-stored original abnormal message identification model based on a training data set, to obtain an abnormal message identification model, where the abnormal message identification model is used to determine whether a to-be-identified message is an abnormal message or a non-abnormal message.

Optionally, the training data set further includes N identifiers of N difference classes corresponding to N second difference values of the N first training messages, the N second difference values are N difference values between the feature values of the N first training messages and feature values of corresponding N third training messages, the N first training messages are in a one-to-one correspondence with the N third training messages, the N third training messages are messages that arrive at the target node before the corresponding first training messages arrive at the target node, and the N third training messages are the non-abnormal messages.

Optionally, the feature value is an arrival time of the message, the N first difference values are arrival time intervals between the N first training messages and the corresponding N second training messages, and the N second difference values are arrival time intervals between the N first training messages and the corresponding N third training messages.

Optionally, the processing unit <NUM> is further configured to: determine a maximum value of feature values of the plurality of training messages and a minimum value of the feature values; determine a value range of the feature value based on the maximum value and the minimum value; and divide a value range of the feature value into a plurality of non-overlapping sub-ranges, where each sub-range corresponds to one first difference class.

In an optional embodiment, the receiving unit <NUM> may be an input/output interface <NUM> of the computing device <NUM>, the processing unit <NUM> may be a processor <NUM> of the computing device <NUM>, and the computing device <NUM> may further include a memory <NUM>. Details are shown in <FIG>.

In an optional embodiment, the obtaining unit <NUM> may be an input/output interface <NUM> of the computing device <NUM>, the processing unit <NUM> may be a processor <NUM> of the computing device <NUM>, and the computing device <NUM> may further include a memory <NUM>. Details are shown in <FIG>.

<FIG> is a schematic diagram of a computing device according to another embodiment of this application. The computing device <NUM> shown in <FIG> may include a memory <NUM>, a processor <NUM>, and an input/output interface <NUM>. The memory <NUM>, the processor <NUM>, and the input/output interface <NUM> are connected by using an internal connection path. The memory <NUM> is configured to store instructions. The processor <NUM> is configured to execute the instructions stored in the memory <NUM>, to control the input/output interface <NUM> to receive input data and information and output data such as an operation result.

In an implementation process, steps in the foregoing methods can be implemented by using a hardware integrated logical circuit in the processor <NUM>, or by using instructions in a form of software. The method for identifying an abnormal message and/or the method for training an abnormal message identification model disclosed with reference to the embodiments of this application may be directly performed and completed by a hardware processor, or may be performed and completed by using a combination of hardware and software modules in the processor. A software module may be located in a mature storage medium in the art, such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, an electrically erasable programmable memory, or a register. The storage medium is located in the memory <NUM>, and a processor <NUM> reads information in the memory <NUM> and completes the steps in the foregoing methods in combination with hardware of the processor. To avoid repetition, details are not described herein again.

It should be understood that, the processor in the embodiments of this application may be a central processing unit (central processing unit, CPU), or may further be another general purpose processor, a digital signal processor (digital signal processor, DSP), an application specific integrated circuit (application specific integrated circuit, ASIC), a field programmable gate array (field programmable gate array, FPGA), or another programmable logical device, discrete gate or transistor logical device, discrete hardware component, or the like. The general purpose processor may be a microprocessor, or the processor may be any conventional processor or the like.

It should be understood that in the embodiments of this application, the memory may include a read-only memory and a random access memory, and provide an instruction and data for the processor. A part of the processor may further include a non-volatile random access memory. For example, the processor may further store information of a device type.

It should be understood that in the embodiments of this application, "B corresponding to A" indicates that B is associated with A, and B may be determined according to A. However, it should further be understood that determining A according to B does not mean that B is determined according to A only; that is, B may also be determined according to A and/or other information.

The term "and/or" in this specification describes only an association relationship for describing associated objects and represents that three relationships may exist.

For example, the unit classification is merely logical function classification and may be other classification in actual implementation.

All or some of the foregoing embodiments may be implemented by using software, hardware, firmware, or any combination thereof. When software is used to implement the embodiments, the embodiments may be implemented completely or partially in a form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on the computer, the procedure or functions according to the embodiments of this application are all or partially generated. The computer may be a general-purpose computer, a dedicated computer, a computer network, or other programmable apparatuses. The computer instructions may be stored in a computer-readable storage medium or may be transmitted from a computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from a website, computer, server, or data center to another website, computer, server, or data center in a wired (for example, a coaxial cable, an optical fiber, or a digital subscriber line (Digital Subscriber Line, DSL)) or wireless (for example, infrared, radio, or microwave) manner. The computer-readable storage medium may be any usable medium accessible by a computer, or a data storage device, such as a server or a data center, integrating one or more usable media. The usable medium may be a magnetic medium (for example, a floppy disk, a hard disk, a magnetic tape), an optical medium (for example, a digital versatile disc (Digital Versatile Disc, DVD)), or a semiconductor medium (for example, a solid-state drive (Solid State Disk, SSD)), or the like.

Claim 1:
A method for identifying an abnormal message, comprising:
receiving, (<NUM>) by a security enforcement unit SEU, a first message, and determining a first difference value between a feature value of the first message and a feature value of a second message, wherein the second message is a message that is received before the first message is received;
determining (<NUM>), by the SEU from a plurality of difference classes, a difference class corresponding to the first difference value, wherein different difference classes in the plurality of difference classes correspond to different value ranges of a difference value; and
inputting (<NUM>), by the SEU, an identifier of the difference class corresponding to the first difference value into a pre-stored abnormal message identification model, to determine whether the first message is an abnormal message or a non-abnormal message,
wherein the different value ranges of the difference values corresponding to the different difference classes in the plurality of difference classes belong to a plurality of preset value ranges, the plurality of preset value ranges are obtained by dividing, according to a natural breakpoint algorithm, a first value range of the feature wherein the first value range of the feature is based on an upper limit of the first value range and a lower limit of the first value range, the upper limit of the first value range is a maximum value corresponding to the feature value in a training data set of the abnormal message identification model, and the lower limit of the first value range is a minimum value corresponding to the feature value in the data set.