METHOD FOR VEHICLE INTRUSION DETECTION WITH MOBILE ROUTER

• US 20140337976A1
• Filed: 05/15/2014
• Published: 11/13/2014
• Est. Priority Date: 05/16/2006
• Status: Active Grant

• Current Assignee: Lear Corporation
• Original Assignee: Autonet Mobile, Inc. (Lear Corporation)
• Inventors: MOELLER, DOUGLAS S., OBRIEN, DANIEL J., MERRITT, JOHN M., TARNUTZER, STEPHAN A., PASHBY, RONALD W,
• Granted Patent: US 9,787,703 B2
• Time in Patent Office: Days
• US Class Current: 726/23
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
• CPC Class Codes: H04W 12/10 Integrity
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware

Abstract

A method of operating a mobile router installed in a vehicle is provided. The vehicle comprises a vehicle network bus coupled to a plurality of electronic control units. The mobile router comprises: a wireless wide area network interface a wireless local area network interface; an interface to the vehicle network bus; a processor; and a memory comprising a plurality of programs. The plurality of programs comprises an intrusion detection program executable by the processor. The method of operating a mobile router comprises: monitoring data on the vehicle network bus; utilizing the intrusion detection program to detect one or more anomalies in the monitored data; and generating an alert upon detection of one or more of anomalies.

Claims

1. A method of operating a mobile router installed in a vehicle;

said vehicle comprising a vehicle network bus coupled to a plurality of electronic control units;

said mobile router comprising;

a wireless wide area network interface

a wireless local area network interface;

an interface to said vehicle network bus coupled to vehicle electronic control units;

a processor; and

an intrusion detection program executable by said processor;

said method comprising;

monitoring data on said vehicle network bus;

utilizing said intrusion detection program to detect one or more anomalies in said monitored data; and

generating an alert upon detection of said one or more of anomalies.

2. A method in accordance with claim 1, wherein:

said mobile router comprise a memory, said memory comprising a plurality of programs and said intrusion detection program; and

said method comprises;

isolating said intrusion detection program from the other of said plurality of programs.

3. A method in accordance with claim 2, comprising:

storing said intrusion detection program in a first memory portion of said memory and storing said other of said plurality of programs in a second memory portion of said memory.

4. A method in accordance with claim 1, wherein:

said intrusion detection program utilizes statistical anomaly detection.

5. A method in accordance with claim 4, wherein:

said intrusion detection program comprises Bayes'"'"' Law.

6. A method in accordance with claim 4, comprising:

transmitting said alert to one of a display in said vehicle, a mobile device, and a server.

7. A method in accordance with claim 4, comprising:

transmitting said alert via a selected one of said wide area network interface and said local area network interface to one of a mobile device and a server.

8. A method in accordance with claim 5, wherein:

said vehicle network bus comprises a Controller Area Network (CAN) bus.

9. A method in accordance with claim 4, comprising:

utilizing a profile of normal data on said vehicle bus based upon learned data.

10. A method in accordance with claim 9, wherein:

said normal data comprises one or more of an amount of normal traffic, identification of normal messages, identification of normal vehicle device to device communication, and identification of normal sensor data.

11. A method in accordance with claim 1, wherein:

said intrusion detection program comprises specification based anomaly detection.

12. A method in accordance with claim 11, comprising:

ignoring all specification compliant data on said vehicle network bus; and

generating said alert for data on said vehicle network bus that is not specification compliant.

13. A method in accordance with claim 11 comprising:

receiving at least one of calibration information and update information for said intrusion detection program via a selected one of said wireless wide area network interface and said wireless local area network interface.

14. A method in accordance with claim 13, comprising:

transmitting said alert to one of a display in said vehicle, a mobile device, and a server.

15. A method in accordance with claim 13, comprising:

transmitting said alert via a selected one of said wide area network interface and said local area network interface to one of a mobile device and a server.

16. A method in accordance with claim 14, wherein:

said vehicle network bus comprises a Controller Area Network (CAN) bus.

17. A method in accordance with claim 11, comprising:

utilizing said specification-based anomaly detection to detect one or more of acceleration patterns, braking patterns, original equipment manufacturer (OEM) provided patterns, counterfeit airbags, and invalid bus identifications.

18. A method in accordance with claim 17 comprising:

receiving at least one of calibration information and update information for said intrusion detection program via a selected one of said wireless wide area network interface and said wireless local area network interface.

19. A method in accordance with claim 1, comprising:

providing an anomaly detection engine; and

utilizing said anomaly detection engine.

20. A method in accordance with claim 18, wherein:

said anomaly detection engine comprises one of statistical anomaly detection and specification based anomaly detection.

21. A method in accordance with claim 1, wherein:

said anomalies comprise one of re-flashing of an electronic control unit memory, and predetermined radio frequency hub activity in said vehicle.

22. A method in accordance with claim 1, comprising:

transmitting said alert to one of a display in said vehicle, a mobile device, and a server.

23. A method in accordance with claim 1, wherein:

said vehicle network bus comprises a Controller Area Network (CAN) bus.

24. A method in accordance with claim 1 comprising:

receiving at least one of calibration information and update information for said intrusion detection program via a selected one of said wireless wide area network interface and said wireless local area network interface.