VEHICLE WITH ELECTRONIC SYSTEM INTRUSION DETECTION

• US 20140247122A1
• Filed: 05/15/2014
• Published: 09/04/2014
• Est. Priority Date: 05/16/2006
• Status: Active Grant

• Current Assignee: Lear Corporation
• Original Assignee: Autonet Mobile, Inc.
• Inventors: MOELLER, DOUGLAS S., PASHBY, RONALD W., OBRIEN, DANIEL J., MERRITT, JOHN M., TARNUTZER, STEPHAN A.
• Granted Patent: US 9,776,597 B2
• Time in Patent Office: Days
• US Class Current: 340/426.25
• CPC Class Codes: B60R 25/10 actuating a signalling device
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: H04L 12/40 Bus networks
• CPC Class Codes: H04L 2012/40273 the transportation system being a vehicle
• CPC Class Codes: H04L 41/06 Management of faults, events, alarms or notifications
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection

Abstract

In an embodiment of a vehicle, the vehicle comprises: a vehicle network bus; one or more electronic control units coupled to the bus. One electronic control unit comprises: a processor; a memory; an interface to the vehicle network bus; and an intrusion detection program stored in the memory and executable by the processor. The processor utilizes the interface to monitor data on the vehicle network bus and utilizes the intrusion detection program to detect one or more anomalies in the monitored data. The electronic control unit generates an alert upon detection of one or more anomalies.

Claims

1. A vehicle comprising:

a vehicle network bus;

one or more electronic control units coupled to said bus;

a predetermined electronic control unit, comprising;

a processor;

a memory;

an interface to said vehicle network bus;

said processor utilizing said interface to monitor data on said vehicle network bus;

an intrusion detection program stored in said memory, said intrusion detection program executable by said processor;

said processor utilizing said intrusion detection program to detect one or more anomalies in said monitored data; and

said electronic control unit generating an alert upon detection of said one or more of anomalies.

2. A vehicle in accordance with claim 1, comprising:

said intrusion detection program comprises statistical anomaly detection.

3. A vehicle in accordance with claim 2, comprising:

said intrusion detection program comprises Bayes'"'"' Law.

4. A vehicle in accordance with claim 3, comprising:

said electronic control unit transmits said alert to one of a display in said vehicle, a mobile device, and a server.

5. A vehicle in accordance with claim 3, wherein:

said electronic control unit comprises a wireless wide area network interface; and

said electronic control unit transmits said alert to one of said mobile device and said server via said wireless wide area network interface.

6. A vehicle in accordance with claim 4, wherein:

said vehicle network bus comprises a Controller Area Network (CAN) bus.

7. A vehicle in accordance with claim 2, comprising:

said statistical anomaly detection utilizes a profile of normal data on said vehicle bus based upon learned data.

8. A vehicle in accordance with claim 7, comprising:

said normal data comprises one or more of an amount of normal traffic, identification of normal messages, identification of normal vehicle device to device communication, and identification of normal sensor data.

9. A vehicle in accordance with claim 1, comprising:

said intrusion detection program comprises specification based anomaly detection.

10. A vehicle in accordance with claim 9, comprising:

said intrusion detection program ignores all specification compliant data on said vehicle network bus and generates said alert for data on said vehicle network bus that is not specification compliant.

11. A vehicle in accordance with claim 10 wherein:

said predetermined electronic control unit comprises a wireless wide area network interface; and

said wireless wide area network interface is operable to receive at least one of calibration information and update information for said intrusion detection program.

12. A vehicle in accordance with claim 11, comprising:

said electronic control unit transmits said alert to one of a display in said vehicle, a mobile device, and a server.

13. A vehicle in accordance with claim 12, wherein:

said vehicle network bus comprises a Controller Area Network (CAN) bus.

14. A vehicle in accordance with claim 9, comprising:

said specification-based anomaly detection is utilized to detect one or more of acceleration patterns, braking patterns, original equipment manufacturer (OEM) provided patterns, counterfeit airbags, and invalid bus identifications.

15. A vehicle in accordance with claim 13 comprising:

said electronic control unit is operable to receive at least one of calibration information and update information for said intrusion detection program via said wide area network interface.

16. A vehicle in accordance with claim 1, comprising:

an anomaly detection engine.

17. A vehicle in accordance with claim 16, comprising:

said anomaly detection engine comprises one of statistical anomaly detection and specification based anomaly detection.

18. A vehicle in accordance with claim 1, comprising:

said anomalies comprise one of reflashing of an electronic control unit memory, and predetermined radio frequency hub activity in said vehicle.

19. A vehicle in accordance with claim 1, comprising:

said electronic control unit transmits said alert to one of a display in said vehicle, a mobile device, and a server.

20. A vehicle in accordance with claim 1, wherein:

said vehicle network bus comprises a Controller Area Network (CAN) bus.

21. A vehicle in accordance with claim 1 wherein:

said predetermined electronic control unit comprise a wireless wide area network interface; and

said wireless wide area network interface is operable to receive at least one of calibration information and update information for said intrusion detection program.