Cooperative cloud-edge vehicle anomaly detection

• US 10,382,466 B2
• Filed: 03/03/2017
• Issued: 08/13/2019
• Est. Priority Date: 03/03/2017
• Status: Active Grant

• Current Assignee: Hitachi, Ltd.
• Original Assignee: Hitachi, Ltd.
• Inventors: Ostergaard, Jeremy
• Primary Examiner(s): Homayounmehr, Farid
• Assistant Examiner(s): Zhu, Zhimei
• Application Number:
  US15/449,693
• Publication Number:
  US 20180255082A1
• Time in Patent Office: 893 Days
• CPC Class Codes: B60R 16/0231 Circuits relating to the driving or the functioning of the vehicle monitoring tyres B60C23/00; indicating overspeed B60K31/00; for dash boards B60K37/00, B60Q3/10; for indicating emergencies B60Q1/52; brake control systems B60T; registering or indicating the working of vehicles G07C5/00; measuring distance G01C, e.g. combinations of speed and distance G01C23/00; engine indicators G01L; measuring speed or acceleration G01P
• CPC Class Codes: B60R 25/30 Detection related to theft or to other events relevant to anti-theft systems
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: G07C 5/008 communicating information to a remotely located station transmission systems for measured values G08C
• CPC Class Codes: G07C 5/02 Registering or indicating driving, working, idle, or waiting time only apparatus forming part of taximeters G07B13/00
• CPC Class Codes: G07C 5/08 Registering or indicating performance data other than driving, working, idle, or waiting time, with or without registering driving, working, idle or waiting time
• CPC Class Codes: G08G 1/0112 from the vehicle, e.g. floating car data [FCD]
• CPC Class Codes: H02P 23/0018 using neural networks
• CPC Class Codes: H02P 23/0031 implementing a off line learning phase to determine and store useful data for on-line control
• CPC Class Codes: H02P 6/34 Modelling or simulation for control purposes
• CPC Class Codes: H04L 12/40176 involving redundancy error detection or correction of the data by redundancy in hardware using active fault-masking in interconnections G06F11/2002; error detection or correction of the data by redundancy in hardware using active fault-masking in storage systems using spares or by reconfiguring G06F11/2053
• CPC Class Codes: H04L 2012/40215 Controller Area Network CAN
• CPC Class Codes: H04L 2012/40273 the transportation system being a vehicle
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 4/40 for vehicles, e.g. vehicle-to-pedestrians [V2P]

Abstract

Example implementations of the present disclosure are directed to systems and methods directed to increasing the accuracy and speed that anomalous and malicious network data can be identified within a vehicle. Through the utilization of example implementations described herein, the security of the vehicle can be increased and the risk of a vehicle'"'"'s internal systems being compromised and property being damaged can be reduced.

Claims

1. A non-transitory computer readable medium, storing instructions to execute a process, the process comprising:

managing model management information associating each of a plurality of analytic models with one or more types of data associated with a vehicle, and an operation status of the vehicle;

receiving data associated with the vehicle;

for receipt of a report from another vehicle or a cloud indicative of the received data being high risk for being anomalous;

reducing a risk threshold for anomaly analysis for the plurality of analytic models;

for receipt of the report from the another vehicle or the cloud indicative of the received data being high risk for being anomalous, or non-receipt of the report from the another vehicle or the cloud;

determining a type of the received data from the vehicle and the operation status of the vehicle;

selecting one or more analytic models of the plurality of analytic models based on the determined type of the received data associated with the vehicle, the determined operation status of the vehicle, and the model management information; and

executing the selected one or more analytic models on the received data to generate an anomaly determination of the received data;

for receipt of the report from the another vehicle or the cloud indicative of the received data being malicious, marking the received data as anomalous; and

for receipt of the report from the another vehicle or the cloud indicative of the received data being safe, marking the received data as safe.

2. The non-transitory computer readable medium of claim 1, the process further comprising, for the anomaly determination indicative of the received data being anomalous, marking the received data as anomalous and generating an alert for the vehicle based on the received data.

3. The non-transitory computer readable medium of claim 1, the process further comprising:

determining the operation status of the vehicle based on the received data; and

determining the type of the received data from a processing of data from one of car area network (CAN) and vehicle Local Area Network (LAN).

4. The non-transitory computer readable medium of claim 3, wherein the received data utilized for determining the operation status of the vehicle comprises at least one of accelerometer data, global positioning satellite (GPS), road traffic data, and engine control unit (ECU) data.

5. The non-transitory computer readable medium of claim 1, wherein the plurality of analytic models comprises an analytic model for advanced driver assistance system (ADAS), an analytic model for vehicle in idle state, and an analytic model for vehicle in driving state.

6. The non-transitory computer readable medium of claim 1, wherein the received data comprises Car Area Network (CAN) data, and wherein the plurality of analytic models comprises historical analytic learning models and manufacturer provided models.

7. The non-transitory computer readable medium of claim 6, the process further comprising executing a model training function on the historical analytic learning models based on the received data.

8. The non-transitory computer readable medium of claim 1, wherein the non-transitory computer readable medium is stored in the vehicle, wherein the process is executed by one or more processors of the vehicle.

9. The non-transitory computer readable medium of claim 1, the process further comprising:

for the received data being marked as anomalous;

for a determination by the cloud that the received data is not anomalous;

providing to the vehicle, results generated from the cloud for the received data based on the selected one or more analytic models;

for a determination by the cloud that the received data is anomalous;

providing an anomaly report to a cloud database and to one or more other vehicles.

10. The non-transitory computer readable medium of claim 1, the process further comprising:

for receipt of an alert for the received data indicative of the received data being anomalous;

modifying a risk score associated with the received data, and for the risk score exceeding a threshold associated with the received data, activating a safety mode of the vehicle;

for receipt of the report from the cloud or from the another vehicle indicative of the received data being malicious, activating the safety mode of the vehicle.

11. A system comprising:

a vehicle platform comprising;

a memory configured to manage model management information associating each of a plurality of analytic models with one or more types of data associated with a vehicle, and an operation status of the vehicle; and

a processor, configured to, receive data associated with the vehicle;

for receipt of a report from another vehicle or a cloud indicative of the received data being high risk for being anomalous;

reduce a risk threshold for anomaly analysis for the plurality of analytic models;

for receipt of the report from the another vehicle or the cloud indicative of the received data being high risk for being anomalous, or non-receipt of the report from the another vehicle or the cloud;

determine a type of the received data from the vehicle and the operation status of the vehicle;

select one or more analytic models of the plurality of analytic models based on the determined type of the received data associated with the vehicle, the determined operation status of the vehicle, and the model management information; and

execute the selected one or more analytic models on the received data to generate an anomaly determination of the received data;

for receipt of the report from the another vehicle or the cloud indicative of the received data being malicious, mark the received data as anomalous; and

for receipt of the report from the another vehicle or the cloud indicative of the received data being safe, mark the received data as safe.

12. The system of claim 11, wherein the processor is configured to, for the anomaly determination indicative of the received data being anomalous, mark the received data as anomalous and generate an alert for the vehicle based on the received data.

13. The system of claim 11, wherein the processor is further configured to:

determine the operation status of the vehicle based on the received data; and

determine the type of the received data from a processing of data from one of car area network (CAN) and vehicle Local Area Network (LAN).

14. The system of claim 13, wherein the received data utilized for determining the operation status of the vehicle comprises at least one of accelerometer data, global positioning satellite (GPS), road traffic data, and engine control unit (ECU) data.

15. The system of claim 11, wherein the plurality of analytic models comprises an analytic model for advanced driver assistance system (ADAS), an analytic model for vehicle in idle state, and an analytic model for vehicle in driving state.

16. The system of claim 11, wherein the received data comprises Car Area Network (CAN) data, and wherein the plurality of analytic models comprises historical analytic learning models and manufacturer provided models.

17. The system of claim 16, wherein the processor is configured to execute a model training function on the historical analytic learning models based on the received data.

18. The system of claim 11, wherein the vehicle platform is stored in the vehicle.

19. The system of claim 11, further comprising an apparatus communicatively coupled to the vehicle platform, the apparatus comprising:

a processor, configured to, for the received data being marked as anomalous;

for a determination that the received data is not anomalous;

provide to the vehicle, generated results from the apparatus for the received data based on the selected one or more analytic models;

for a determination that the received data is anomalous;

provide an anomaly report to a cloud database and to one or more other vehicles.

20. The system of claim 11, wherein the processor is further configured to:

for receipt of an alert for the received data indicative of the received data being anomalous;

modify a risk score associated with the received data, and for the risk score exceeding a threshold associated with the received data, activating a safety mode of the vehicle;

for receipt of the report from the cloud or from the another vehicle indicative of the received data being malicious, activate the safety mode of the vehicle.