METHOD FOR VEHICLE INTRUSION DETECTION WITH ELECTRONIC CONTROL UNIT

• US 20140250531A1
• Filed: 05/15/2014
• Published: 09/04/2014
• Est. Priority Date: 05/16/2006
• Status: Active Grant

• Current Assignee: Lear Corporation
• Original Assignee: Autonet Mobile, Inc. (Lear Corporation)
• Inventors: MOELLER, DOUGLAS S, PASHBY, RONALD W, OBRIEN, DANIEL J, MERRITT, JOHN M, TARNUTZER, STEPHAN A
• Granted Patent: US 9,813,436 B2
• Time in Patent Office: Days
• US Class Current: 726/23
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
• CPC Class Codes: H04W 4/029 Location-based management or tracking services

Abstract

A method of operating a predetermined electronic control unit is provided for a vehicle comprising: a vehicle network bus and one or more electronic control units coupled to the bus. The method comprises: providing the predetermined electronic control unit of with a processor, a memory, an interface to the vehicle network bus, and an intrusion detection program. The method further comprises: utilizing the predetermined electronic control unit to monitor data on the vehicle network bus; executing the intrusion detection program to detect one or more anomalies in the monitored data; and utilizing the predetermined electronic control unit to generate an alert upon detection of one or more anomalies.

Claims

1. A method of operating a predetermined electronic control unit disposed in a vehicle comprising a vehicle network bus and one or more electronic control units coupled to said vehicle network bus, said predetermined electronic control unit comprising a processor, a memory, and an interface to said vehicle network bus, said method comprising:

providing said predetermined electronic control unit with an intrusion detection program;

executing said intrusion detection program to monitor data on said vehicle network bus;

executing said intrusion detection program to detect one or more anomalies in said monitored data; and

generating an alert upon detection of said one or more of anomalies.

2. A method in accordance with claim 1, comprising:

utilizing statistical anomaly detection in said intrusion detection program.

3. A method in accordance with claim 2, comprising:

utilizing Bayes'"'"' Law in said intrusion detection program.

4. A method in accordance with claim 3, comprising:

transmitting said alert to one of a display in said vehicle, a mobile device, and a server.

5. A method in accordance with claim 1, comprising:

transmitting said alert to one of said mobile device and a server via a wireless wide area network interface.

6. A method in accordance with claim 1, wherein:

said vehicle network bus comprises a Controller Area Network (CAN) bus.

7. A method in accordance with claim 2:

utilizing a profile of normal data on said vehicle bus, said profile of normal data being based upon learned data.

8. A method in accordance with claim 7, wherein:

selecting said normal data as comprising one or more of an amount of normal traffic, identification of normal messages, identification of normal vehicle device to device communication, and identification of normal sensor data.

9. A method in accordance with claim 1, comprising:

providing said intrusion detection program with specification based anomaly detection.

10. A method in accordance with claim 9, comprising:

executing said intrusion detection program to ignore all specification compliant data on said vehicle network bus; and

generating said alert for data on said vehicle network bus that is not specification compliant.

11. A method in accordance with claim 10 comprising:

receiving at least one of calibration information and update information for said intrusion detection program via a wireless wide area network interface.

12. A method in accordance with claim 11, comprising:

transmitting said alert to one of a display in said vehicle, a mobile device, and a server.

13. A method in accordance with claim 12, wherein:

said vehicle network bus comprises a Controller Area Network (CAN) bus.

14. A method in accordance with claim 9, comprising:

utilizing said specification-based anomaly detection to detect one or more of acceleration patterns, braking patterns, original equipment manufacturer (OEM) provided patterns, counterfeit airbags, and invalid bus identifications.

15. A method in accordance with claim 14 comprising:

receiving at least one of calibration information and update information for said intrusion detection program via said wide area network interface.

16. A method in accordance with claim 1, comprising:

providing said predetermined electronic control unit with an anomaly detection engine.

17. A method in accordance with claim 16, comprising:

selecting said anomaly detection engine to comprise one of statistical anomaly detection and specification based anomaly detection.

18. A method in accordance with claim 17, wherein:

said anomalies comprise one of re-flashing of an electronic control unit memory, and predetermined radio frequency hub activity in said vehicle.

19. A method in accordance with claim 1, comprising:

utilizing Bayes'"'"' Law in said intrusion detection program.

20. A method in accordance with claim 1, wherein:

said anomalies comprise one of re-flashing of an electronic control unit memory, and predetermined radio frequency hub activity in said vehicle.

21. A method in accordance with claim 1 comprising:

receiving at least one of calibration information and update information for said intrusion detection program.