Avionics intrusion detection system and method of determining intrusion of an avionics component or system

• US 9,591,005 B2
• Filed: 08/20/2014
• Issued: 03/07/2017
• Est. Priority Date: 08/20/2014
• Status: Active Grant

• Current Assignee: GE Aviation Systems LLC (GE Aerospace)
• Original Assignee: GE Aviation Systems LLC (GE Aerospace)
• Inventors: Buehler, Eric Daniel, Duffner, Kevin Patrick
• Primary Examiner(s): Schwartz, Darren B
• Application Number:
  US14/464,131
• Publication Number:
  US 20160057160A1
• Time in Patent Office: 930 Days
• US Class Current: 1/1
• CPC Class Codes: B64D 2045/0085 Devices for aircraft health monitoring, e.g. monitoring flutter or vibration
• CPC Class Codes: B64D 45/00 Aircraft indicators or protectors not otherwise provided for camouflage F41H3/00
• CPC Class Codes: B64D 45/0059 by communicating emergency situations to ground control or between crew members
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G07C 5/008 communicating information to a remotely located station transmission systems for measured values G08C
• CPC Class Codes: G07C 5/0816 Indicating performance data, e.g. occurrence of a malfunction
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A system for an aircraft and method of determining intrusion of an avionics component or system in an aircraft having multiple avionics components and systems communicating over an aircraft communications network monitored by a system, including monitoring, by the system, data communication over the aircraft communications network for at least some of the avionics components or system and comparing, by the system, the monitored communications for the at least some of the avionics components to corresponding operational profiles.

Claims

1. A method of determining intrusion of an avionics component or avionics system in an aircraft having multiple avionics components and avionics systems communicating over an aircraft communications network monitored by an intrusion system, the method comprising:

monitoring, by the intrusion system, data communication over the aircraft communications network for one or more of the avionics components or avionics systems;

comparing, by the intrusion system, the monitored communications for at least one of the avionics components or avionics systems to a corresponding operational profile that includes acceptable interactions between multiple avionics components or avionics systems;

determining an intrusion for the at least one of the avionics components or avionics systems when the comparison indicates that the at least one of the avionics components or avionics systems satisfies an intrusion profile based on data redundancy checks and trend not matching; and

providing an alert of the determined intrusion.

2. The method of claim 1 wherein the intrusion is determined by the intrusion system in real-time.

3. The method of claim 1 wherein providing the alert comprises transmitting the alert off the aircraft.

4. The method of claim 1 wherein providing the alert comprises transmitting the alert over the communications network.

5. The method of claim 1 wherein the operational profile comprises acceptable interactions between throttle data and airspeed data.

6. The method of claim 1, further comprising updating the operational profiles and intrusion profiles based on analysis of the monitored data.

7. The method of claim 1 wherein the comparison with the operational profile may indicate at least one of unusual message payloads, new information sources, operational phase specific markers, location specific markers.

8. The method of claim 1 wherein the operational profile differs for each phase of flight.

9. The method of claim 1 wherein the monitoring, comparing, and determining are continually repeated.

10. The method of claim 1 wherein the intrusion profile is satisfied when the comparison indicates the monitored data is outside of the operational profile.

11. An aircraft monitoring system for detecting intrusion into an avionics component or avionics system of an aircraft, which has multiple avionics components and avionics systems, comprising:

a controller monitoring data from multiple avionics components and avionics systems of the aircraft and having a primary avionics purpose and a secondary security purpose wherein the controller is configured to compare the monitored data for the one or more of the avionics components or avionics systems to corresponding operational profiles, determine an intrusion for at least one of the avionics components or avionics systems when the comparison indicates the at least one of the avionics components or avionics systems satisfies an intrusion profile for the at least one of the avionics components or avionics systems, and provide an alert of the determined intrusion and wherein the intrusion profile is satisfied when there is a command to use unreliable data or based on data redundancy checks and trend not matching.

12. The aircraft monitoring system of claim 11, further comprising a communication module operably coupled to the controller and where the communication module is configured to provide an alert regarding the intrusion on a component of the aircraft.

13. The aircraft monitoring system of claim 11 wherein the controller is configured to detect unusual message payloads, new information sources, operational phase specific markers, location specific markers and determine intrusions based thereon.

14. A method of determining intrusion of an avionics component or avionics system in an aircraft having multiple avionics components and avionics systems communicating over an aircraft communications network monitored by an intrusion system, the method comprising:

monitoring, by the intrusion system, data communication over the aircraft communications network for one or more of the avionics components or avionics systems;

comparing, by the intrusion system, the monitored communications for at least one of the avionics components or avionics systems to a corresponding operational profile;

determining from the comparing that the at least one of the avionics components or avionics systems has been commanded to use unreliable data, wherein the commanded use of unreliable data satisfies an intrusion profile;

determining an intrusion for the at least one of the avionics components or avionics systems based on the satisfying of the intrusion profile; and

providing an alert of the determined intrusion.

15. The method of claim 14 wherein the operational profile relates to a single operational parameter.

16. The method of claim 15 wherein the single operational parameter relates to life variation, aircraft performance, component performance, long term performance, or like component comparisons.

17. The method of claim 14 wherein the operational profile relates to multiple avionics components or avionics systems.