METHOD FOR VEHICLE ELECTRONIC SYSTEM INTRUSION DETECTION

• US 20140250530A1
• Filed: 05/15/2014
• Published: 09/04/2014
• Est. Priority Date: 05/16/2006
• Status: Active Grant

• Current Assignee: Lear Corporation
• Original Assignee: Autonet Mobile, Inc. (Lear Corporation)
• Inventors: MOELLER, DOUGLAS S., PASHBY, RONALD W., OBRIEN, DANIEL J., MERRITT, JOHN M., TARNUTZER, STEPHAN A.
• Granted Patent: US 9,787,694 B2
• Time in Patent Office: Days
• US Class Current: 726/23
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
• CPC Class Codes: H04W 4/029 Location-based management or tracking services
• CPC Class Codes: H04W 4/40 for vehicles, e.g. vehicle-to-pedestrians [V2P]

Abstract

An embodiment is provided of a mobile router for installation in a vehicle comprising a vehicle network bus coupled to a plurality of electronic control units. The mobile router comprises: a processor; a memory comprising a plurality of programs; a wireless wide area network interface; a wireless local area network interface; and an interface to the vehicle network bus coupled to vehicle electronic control units. The processor utilizes the interface to monitor data on the vehicle network bus. The plurality of programs comprises an intrusion detection program executable by the processor to detect one or more anomalies in the monitored data; and to generate an alert upon detection of one or more anomalies.

Claims

1. A method for providing vehicle intrusion detection for a vehicle comprising a vehicle network bus and electronic control units coupled to said vehicle network bus, said method comprising:

providing said vehicle with a predetermined electronic control unit, said predetermined electronic control unit comprising;

a processor;

a memory; and

an interface to said vehicle network bus;

operating said electronic control unit to monitor data on said vehicle network bus;

storing an intrusion detection program in said memory;

operating said processor to execute said intrusion detection program to detect one or more types of anomalies in said monitored data; and

operating said predetermined electronic control unit to generate an alert upon detection of said one or more of anomalies.

2. A method in accordance with claim 1, comprising:

utilizing statistical anomaly detection to detect said one or more types of anomalies.

3. A method in accordance with claim 2, comprising:

utilizing Bayes'"'"' Law to detect said one or more types of anomalies.

4. A method in accordance with claim 3, comprising:

operating said predetermined electronic control unit to transmit said alert to one of a display in said vehicle, a mobile device, and a server.

5. A method in accordance with claim 4, wherein:

said vehicle network bus comprises a Controller Area Network (CAN) bus.

6. A method in accordance with claim 2, comprising:

utilizing a profile of normal data on said vehicle bus based upon learned data for said statistical anomaly detection.

7. A method in accordance with claim 6, comprising:

selecting said normal data to be one or more of an amount of normal traffic, identification of normal messages, identification of normal vehicle device to device communication, and identification of normal sensor data.

8. A method in accordance with claim 1, comprising:

utilizing specification based anomaly detection in said intrusion detection program.

9. A method in accordance with claim 8, comprising:

operating said predetermined electronic control unit to ignore all specification compliant data on said vehicle network bus; and

generating said alert for data on said vehicle network bus that is not specification compliant.

10. A method in accordance with claim 9 comprising:

providing said predetermined electronic control unit with access to a wireless wide area network interface;

receiving at least one of calibration information and update information for said intrusion detection program via said wireless wide area network interface.

11. A method in accordance with claim 10, comprising:

operating said predetermined electronic control unit to transmit said alert to one of a display in said vehicle, a mobile device, and a server.

12. A method in accordance with claim 11, wherein:

said vehicle network bus comprises a Controller Area Network (CAN) bus.

13. A method in accordance with claim 8, comprising:

utilizing said specification-based anomaly detection to detect one or more of acceleration patterns, braking patterns, original equipment manufacturer (OEM) provided patterns, counterfeit airbags, spoofing of vehicle bus messages and/or IDs'"'"', and invalid bus identifications.

14. A method in accordance with claim 13 comprising:

utilizing said wireless wide area network interface to receive at least one of calibration information and update information for said intrusion detection program.

15. A method in accordance with claim 1, comprising:

providing said predetermined electronic control unit with an anomaly detection engine.

16. A method in accordance with claim 15, comprising:

selecting said anomaly detection engine to comprise one of statistical anomaly detection and specification based anomaly detection.

17. A method in accordance with claim 1, wherein:

said anomalies comprise one of reflashing of an electronic control unit memory, and predetermined radio frequency hub activity in said vehicle.

18. A method in accordance with claim 1, comprising:

operating said predetermined electronic control unit to transmit said alert to one of a display in said vehicle, a mobile device, and a server.

19. A method in accordance with claim 1, wherein:

said vehicle network bus comprises a Controller Area Network (CAN) bus.

20. A method in accordance with claim 1 comprising:

utilizing said wireless wide area network interface to receive at least one of calibration information and update information for said intrusion detection program.