Sensor data anomaly detector

• US 10,005,427 B2
• Filed: 09/18/2017
• Issued: 06/26/2018
• Est. Priority Date: 04/09/2014
• Status: Expired due to Fees

• Current Assignee: Inspire Licensing LLC (IP Edge LLC)
• Original Assignee: Empire Technology Development LLC (Allied Inventors Management, LLC)
• Inventors: Ur, Shmuel, Hirshberg, David, Bushinsky, Shay, Dabija, Vlad Grigore, Fligler, Ariel
• Primary Examiner(s): Dsouza, Adolf
• Application Number:
  US15/707,436
• Publication Number:
  US 20180001869A1
• Time in Patent Office: 281 Days
• Field of Search: None
• CPC Class Codes: B60R 25/102 a signal being sent to a remote location, e.g. a radio signal being transmitted to a police station, a security company or the owner
• CPC Class Codes: B60W 2050/0005 Processor details or data handling, e.g. memory registers or chip architecture
• CPC Class Codes: B60W 2050/0075 Automatic parameter input, automatic initialising or calibrating means
• CPC Class Codes: B60W 2050/0215 Sensor drifts or sensor failures
• CPC Class Codes: B60W 2556/10 Historical data
• CPC Class Codes: B60W 50/045 Monitoring control system parameters
• CPC Class Codes: G01R 31/2829 Testing of circuits in sensor or actuator systems testing of apparatus for measuring electric or magnetic variables G01R35/00; testing of indicating or recording apparatus G01D; in airbag systems B60R21/0173; checking gas analysers G01N33/007; monitoring or fail-safe circuits for electromagnets H01F7/1844
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2111/20 Configuration CAD, e.g. designing by assembling or positioning modules selected from libraries of predesigned modules
• CPC Class Codes: G06F 2113/12 Cloth
• CPC Class Codes: G06F 30/23 using finite element methods [FEM] or finite difference methods [FDM]
• CPC Class Codes: G08B 21/182 Level alarms, e.g. alarms responsive to variables exceeding a threshold

Abstract

Methods and systems are provided that are effective to generate an alarm for a vehicle. The methods include receiving, by a device, a first sensor value from a first sensor for the vehicle. The methods further include receiving, by the device, a second sensor value from a second sensor for the vehicle. The methods further include retrieving, by the device, an instruction from a memory disposed in the vehicle while the memory is in a write-protected mode. The methods further include evaluating, by the device, the first sensor value and the second sensor value based on the instruction. The methods further include determining, by the device, that the first sensor value is outside a range associated with the first sensor based on the evaluation. The methods further include transforming, by the device, the determination into an alarm.

Claims

1. A method to detect an attack on a vehicle, the method comprising:

receiving a sensor value from a sensor associated with the vehicle;

in response to receiving the sensor value, generating sample data to be written onto a memory which is disposed in the vehicle;

attempting to write the generated sample data to the memory;

detecting the attack on the vehicle, wherein the detection of the attack is based on a determination that the attempt to write the generated sample data to the memory is unsuccessful; and

generating an alarm that is indicative of the detected attack on the vehicle.

2. The method of claim 1, wherein receiving the sensor value from the sensor comprises receiving a value of a speed of the vehicle from a speedometer associated with the vehicle.

3. The method of claim 1, wherein the memory is configured to operate in one of a write-access mode and a write-protected mode.

4. The method of claim 3, further comprising:

activating the write-access mode for the memory, while the vehicle is stopped; and

activating the write-protected mode for the memory, while the vehicle is in motion.

5. The method of claim 1, wherein detecting the attack on the vehicle comprises detecting one of a jamming attack, a spoofing attack, or a root gaining attack.

6. A method to generate an alarm for a vehicle, the method comprising:

receiving a sensor value from a sensor associated with the vehicle;

determining a current mode of operation of a memory disposed in the vehicle, wherein the memory is configured to be in communication with the sensor;

evaluating whether the sensor value corresponds to the current mode of operation of the memory; and

generating the alarm, which indicates an error related to the sensor, in response to an evaluation that the sensor value does not correspond to the current mode of operation of the memory.

7. The method of claim 6, further comprising:

modifying the sensor value in response to the evaluation that the sensor value does not correspond to the current mode of operation of the memory.

8. The method of claim 6, wherein the memory is configured to operate in one of a write-access mode or a write-protected mode.

9. The method of claim 6, further comprising:

in response to an evaluation that the sensor value corresponds to the current mode of operation of the memory;

retrieving an instruction from the memory;

analyzing the sensor value based on the instruction;

determining, based on the analysis, that the sensor value is outside a range associated with the sensor; and

transforming the determination that the sensor value is outside the range, into the alarm.

10. The method of claim 9, wherein the range is based on historical data that corresponds to the sensor.

11. A system configured to generate an alarm for a vehicle, the system comprising:

a sensor for the vehicle; and

a processor in communication with the sensor, wherein the processor is configured to;

receive a sensor value from the sensor;

receive historical data that corresponds to the sensor;

determine a difference between the sensor value and the historical data;

receive an instruction, while a memory disposed in the vehicle is in a write-protected mode;

determine, based on the instruction, whether the sensor value is consistent with the historical data;

determine, based on the difference and on a determination that the sensor value is inconsistent with the historical data, that the sensor value is outside a range which is associated with the sensor, wherein the range is based on the historical data; and

transform the determination that the sensor value is outside the range, into the alarm, to indicate that the sensor value is an anomaly.

12. The system of claim 11, wherein the processor is configured to:

receive a model, wherein the model includes the historical data; and

store the model in the memory disposed in the vehicle, while the memory is operating in a write-access mode.

13. The system of claim 12, wherein the processor is further configured to:

activate the write-access mode for the memory, while the vehicle is stopped; and

activate the write-protected mode for the memory, while the vehicle is in motion.

14. The system of claim 11, wherein the sensor value corresponds to a location of the vehicle.

15. The system of claim 11, wherein the sensor value includes a first sensor value and the sensor includes a first sensor, and wherein the processor is further configured to:

receive a second sensor value from a second sensor associated the vehicle;

receive a third sensor value from a third sensor disposed outside of the vehicle;

compute a first difference between the first sensor value and the third sensor value; and

compute a second difference between the second sensor value and the third sensor value,

wherein the determination that the sensor value is outside the range is further based on the computed first difference and the computed second difference.

16. A system to detect an attack on a vehicle, the system comprising:

a sensor for the vehicle; and

a processor in communication with the sensor, wherein the processor is configured to;

receive a sensor value from the sensor;

in response to the received sensor value, generate sample data to be written onto a memory which is disposed in the vehicle;

attempt to write the generated sample data to the memory;

detect the attack on the vehicle, wherein the detection of the attack is based on a determination that the attempt to write the generated sample data to the memory is unsuccessful; and

generate an alarm that is indicative of the detected attack on the vehicle.

17. The system of claim 16, wherein the memory is configured to operate in one of a write-access mode and a write-protected mode.

18. The system of claim 17, wherein the processor is further configured to:

activate the write-access mode for the memory, while the vehicle is stopped; and

activate the write-protected mode for the memory, while the vehicle is in motion.

19. A system, comprising:

a sensor for a vehicle; and

a processor in communication with the sensor, wherein the processor is configured to;

receive a sensor value from the sensor;

determine a current mode of operation of a memory disposed in the vehicle, wherein the memory is configured to be in communication with the sensor;

evaluate whether the sensor value corresponds to the current mode of operation of the memory; and

generate an alarm that indicates an error related to the sensor, in response to an evaluation that the sensor value does not correspond to the current mode of operation of the memory.

20. The system of claim 19, wherein in response to an evaluation that the sensor value corresponds to the current mode of operation of the memory, the processor is configured to:

retrieve an instruction from the memory, while the current mode of operation of the memory is a write-protected mode;

analyze the sensor value based on the instruction;

determine, based on the analysis, that the sensor value is outside a range associated with the sensor; and

transform the determination that the sensor value is outside the range, into the alarm.

21. A system configured to generate an alarm for a vehicle, the system comprising:

a first sensor for the vehicle;

a second sensor for the vehicle;

a memory configured to store instructions to evaluate sensor values of the first sensor and the second sensor; and

a processor configured to be in communication with the first sensor, the second sensor, and the memory, wherein the processor is configured to perform or cause to be performed operations that comprise;

generate a model, wherein the model includes historical data that corresponds to the first sensor;

store the model in the memory;

evaluate, based on the instructions, a first sensor value from the first sensor and a second sensor value from the second sensor;

determine a difference between the first sensor value and the historical data;

determine, based on the evaluation and on the determined difference, that the first sensor value is outside a range associated with the first sensor, wherein the range is based on the historical data that corresponds to the first sensor; and

generate the alarm, in response to the determination that the first sensor value is outside the range, to indicate that the sensor value is an anomaly.

22. The system of claim 21, wherein the memory is configured to operate in one of a write-access mode and a write-protected mode.

23. The system of claim 22, wherein the operations further comprise:

activate the write-access mode for the memory, while the vehicle is stopped; and

activate the write-protected mode for the memory, while the vehicle is in motion.

24. A method to detect an attack on a vehicle, the method comprising:

receiving a first sensor value from a first sensor for the vehicle;

receiving a second sensor value from a second sensor for the vehicle;

generating a model, wherein the model includes historical data that corresponds to the first sensor;

storing the model in a memory, wherein the memory includes instructions to evaluate the first sensor value and the second sensor value;

evaluating, based on the instructions, the first sensor value and the second sensor value;

determining a difference between the first sensor value and the historical data;

determining, based on the evaluation and the determined difference, that the first sensor value is outside a range associated with the first sensor, wherein the range is based on the historical data that corresponds to the first sensor; and

generating an alarm, in response to the determination that the first sensor value is outside the range, to indicate the detection of the attack on the vehicle.

25. The method of claim 24, wherein the memory is configured to operate in one of a write-access mode and a write-protected mode.

26. The method of claim 25, further comprising:

activating the write-access mode for the memory, while the vehicle is stopped; and

activating the write-protected mode for the memory, while the vehicle is in motion.