System and method for detecting malicious activity and harmful hardware/software modifications to a vehicle

• US 9,525,700 B1
• Filed: 10/16/2014
• Issued: 12/20/2016
• Est. Priority Date: 01/25/2013
• Status: Active Grant

• Current Assignee: Remtcs Inc.
• Original Assignee: Remtcs Inc.
• Inventors: Malinowski, Richard E., Xaypanya, Tommy
• Primary Examiner(s): Mehrmanesh, Amir
• Assistant Examiner(s): Fields, Courtney
• Application Number:
  US14/516,418
• Publication Number:
  US 20160378103A1
• Time in Patent Office: 796 Days
• US Class Current: 1/1
• CPC Class Codes: G05B 23/0262 Confirmation of fault detection, e.g. extra checks to confirm that a failure has indeed occurred
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: G06N 3/08 Learning methods
• CPC Class Codes: G06N 5/04 Inference or reasoning models
• CPC Class Codes: G06N 7/01 Probabilistic graphical models, e.g. probabilistic networks
• CPC Class Codes: G07C 5/0825 using optical means
• CPC Class Codes: H04L 41/0659 by isolating or reconfiguring faulty entities
• CPC Class Codes: H04L 41/145 involving simulating, designing, planning or modelling of a network
• CPC Class Codes: H04L 41/16 using machine learning or artificial intelligence
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware
• CPC Class Codes: H04W 4/90 Services for handling of emergency or hazardous situations, e.g. earthquake and tsunami warning systems [ETWS]

Abstract

An Artificial Intelligence (AI) interface and engine is described that enables the monitoring and analysis of vehicle information to determine if the vehicle has had at least one of hardware and software maliciously changed, added, or removed. The AI interface may determine the presence of the maliciously changed, added, or removed hardware and/or software such as by receiving an emergency condition from at least one sensor that is in disagreement with another sensor.

Claims

1. A vehicle monitoring and analysis system, comprising:

a computing device configured to receive, from a vehicle under analysis, an emergency state from an emergency reporting sensor and to receive one or more data inputs from a plurality of sensors from the vehicle under analysis;

an artificial intelligence engine configured to analyze the emergency state with the data input from a selected portion of the sensors comprising less than all of the plurality of sensors to confirm that the emergency state exists, wherein the selected portion of the sensors excludes ones of the sensors determined to be untrusted, due to a determined likelihood of the presence of malware, and omitting data inputs from the excluded ones of the sensors when confirming that the emergency state exists;

the computing device being configured to, upon the artificial intelligence engine determining that the emergency state is not in error, processing the emergency state; and

the computing device being configured to, upon the artificial intelligence engine determining that the emergency state is in error, processing a false emergency state.

2. The system of claim 1, wherein

the artificial intelligence engine further analyzes the emergency state with the selected portion of the sensors to determine if the emergency state is associated with occupant injuries;

upon determining the emergency state is associated with occupant injuries, the artificial intelligence engine causes the vehicle to present a voice prompt to be played to a vehicle occupant; and

wherein the artificial intelligence engine further determines if the emergency state is in error in accordance with a response received to the voice prompt.

3. The system of claim 2, wherein the artificial intelligence engine confirms the emergency state is not in error upon receiving, prior to receiving the response to the voice prompt, a timeout indicator associated with a previously determined wait time duration.

4. The system of claim 3, wherein the artificial intelligence engine, upon receiving the timeout indicator, causes the vehicle to present a prompt to solicit a tactile response from the occupant via at least one physical input device of the vehicle.

5. The system of claim 3, wherein the artificial intelligence engine, upon receiving the timeout indicator, causes the vehicle to present a visual prompt on a display of the vehicle.

6. The system of claim 1, wherein at least a portion of at least one of the computing device and the artificial intelligence engine is located externally to the vehicle and in communication with the vehicle via a communications link.

7. The system of claim 1, wherein:

the artificial intelligence engine determines a selected one sensor of the selected portion of the sensors as being deterministic as to whether the emergency state is in error or not in error;

the artificial intelligence engine accesses a data input from the selected one sensor of the selected portion of the sensors;

wherein determining the emergency state is not in error further comprises, determining, by the artificial intelligence engine, at least one value of the data input from the selected one sensor of the selected portion of the sensors confirms the emergency state; and

wherein determining the emergency state is in error further comprises, determining, by the artificial intelligence engine, at least one value of the data input from the selected one sensor of the selected portion of the sensors confirms the false emergency state.

8. The system of claim 1, wherein processing the false emergency state comprises causing the computing device to present a notification by at least one of a display within the vehicle, a handheld computer in communication with the vehicle, and a centralized reporting system in communication with the vehicle, wherein the notification comprises indicia of the false emergency state.

9. The system of claim 8, wherein the notification further comprises indicia of malware.

10. The system of claim 1, wherein the emergency reporting sensor is one of the plurality of sensors.

11. A vehicle monitoring and analysis system, comprising:

a computing device configured to receive data inputs from a vehicle under analysis;

an artificial intelligence engine configured to receive and analyze the data inputs to determine if the vehicle has had a modification comprising at least one of an unauthorized hardware and an unauthorized software modification, wherein the determination further comprises determining whether data from one of the data inputs validates the data from a different one of the data inputs or the data from one of the data inputs invalidates the data from the different one of the data inputs; and

the artificial intelligence engine, upon determining the data from one of the data inputs invalidates the data from the different one of the data inputs, selects a countermeasure to the at least one of the unauthorized hardware and the unauthorized software modification and launches the selected countermeasure, and wherein the selected countermeasure comprises, excluding the data inputs, received from a sensor providing at least one of the data from one of the data inputs and the data from the different one of the data inputs, from an emergency state determination.

12. The system of claim 11, the computing device comprises a mobile communications device.

13. The system of claim 12, wherein the mobile communications device comprises a smartphone that includes the artificial intelligence engine.

14. The system of claim 12, wherein the artificial intelligence engine is provided on a device other than the mobile communications device.

15. The system of claim 11, wherein the one or more data inputs includes at least one input from a controller area network data bus (CAN BUS) system.

16. The system of claim 15, wherein the CAN BUS system comprises a vehicle bus standard designed to allow microcontrollers and devices to communicate with each other within the vehicle without a host computer.

17. The system of claim 15, wherein the one or more data inputs include at least one of vehicle brake information, vehicle information, vehicle traction information, vehicle diagnostics information, fluid level information, and tire pressure information.

18. A vehicle monitoring and analysis system, comprising:

a computing device configured to receive data inputs from a plurality of vehicles under analysis;

an artificial intelligence engine configured to receive and analyze the data inputs to determine if a first vehicle of the plurality of vehicles indicates the presence of malware, the determination further comprises determining a data input from a first sensor from the first vehicle is in disagreement with a second sensor from the first vehicle; and

reporting, to an artificial intelligence engine associated with a second vehicle that the second vehicle indicates the presence of malware and causing the artificial intelligence engine associated with the second vehicle to exclude data inputs from at least one of a corresponding first sensor of the first vehicle and a corresponding second sensor of the first vehicle from a determination of an emergency state of the second vehicle.

19. The system of claim 18, wherein the artificial intelligence engine analyzes the data inputs by comparing a first set of data inputs to a trusted collection of data inputs;

and

wherein the determination of the first vehicle indicates the presence of malware, further comprises, determining a first set of data inputs associated with the first vehicle is outside of threshold deviation from the trusted collection of data inputs.

20. The system of claim 18, wherein the computing device is configured to receive the data inputs via a communication module associated with ones of the plurality of vehicles and a communication module associated with the computing device.