Electronic control unit with vehicle intrusion detection

• US 9,787,702 B2
• Filed: 05/15/2014
• Issued: 10/10/2017
• Est. Priority Date: 05/16/2006
• Status: Active Grant

• Current Assignee: Lear Corporation
• Original Assignee: Lear Corporation
• Inventors: Moeller, Douglas S, Pashby, Ronald W, Obrien, Daniel J, Merritt, John M, Tarnutzer, Stephan A
• Primary Examiner(s): Orgad, Edan
• Assistant Examiner(s): COSTIN, JEREMY M
• Application Number:
  US14/278,160
• Publication Number:
  US 20140250528A1
• Time in Patent Office: 1,244 Days
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection

Abstract

An electronic control unit is provided for installation in a vehicle. The electronic control unit is operable to provide intrusion detection for the vehicle electronic systems. The electronic control unit comprises: a processor; a memory; and an interface to a vehicle network bus coupled to vehicle electronic control units. The processor utilizes the interface to monitor data on the vehicle network bus. An intrusion detection program is stored in the memory and is executable by the processor. The processor utilizes the intrusion detection program to detect one or more anomalies in the monitored data. The electronic control unit generates an alert upon detection of one or more anomalies.

Claims

1. An electronic control unit for installation in a vehicle operable to provide electronic intrusion detection for said vehicle, said vehicle comprising a wireless local area network mobile with said vehicle and comprising a wireless wide area network, said electronic control unit comprising:

a processor;

a memory dedicated to said electronic control unit;

a wireless wide area network interface to access said wireless wide area network;

a wireless local area network interface operable to provide said mobile wireless local area network for one or more mobile devices;

said electronic control unit operable to route data between said one or more mobile devices located in said vehicle coupled to said wireless local area network mobile with said vehicle and said wireless wide area network;

an interface to a vehicle network bus, said vehicle network bus coupled to vehicle electronic control units embedded in said vehicle and each said vehicle electronic control units comprising a vehicle electronic control unit processor and a separate dedicated vehicle electronic control unit memory comprising embedded software for controlling operation of said vehicle electronic control unit;

said processor utilizing said interface to monitor data on said vehicle network bus;

an intrusion detection program stored in said memory, said intrusion detection program executable by said processor, said intrusion detection program is isolated from any other programs including any other programs stored in said memory to insure the integrity of said intrusion detection program by utilizing one or more memory isolation approaches to isolate said intrusion detection program from said any other programs in said vehicle including all said any other programs stored in said memory dedicated to said electronic control unit;

said processor utilizing said intrusion detection program to detect one or more anomalies indicative of electronic intrusion in said monitored data;

said one or more anomalies comprise reflashing of an electronic control unit memory and predetermined radio frequency hub activity in said vehicle of a type that comprises attempts to determine a predetermined code assigned to said vehicle;

said wireless wide area network interface and said wireless local area network interface are selectively operable to receive at least one of calibration information and update information for said intrusion detection program; and

said electronic control unit generating an alert indicative of an electronic intrusion upon detection of said one or more of anomalies indicative of an electronic intrusion.

2. The electronic control unit in accordance with claim 1, comprising:

said intrusion detection program comprises statistical anomaly detection for detection of said one or more anomalies indicative of an electronic intrusion.

3. The electronic control unit in accordance with claim 1, comprising:

said intrusion detection program comprises Bayes'"'"' Law.

4. The electronic control unit in accordance with claim 3, comprising:

said electronic control unit transmits said alert indicative of an electronic intrusion to one of a display in said vehicle, a mobile device, or a server.

5. The electronic control unit in accordance with claim 4, wherein:

said vehicle network bus comprises a Controller Area Network (CAN) bus.

6. The electronic control unit in accordance with claim 2, comprising:

said statistical anomaly detection utilizes a profile of normal data on said vehicle bus based upon learned data to detect said one or more anomalies indicative of an electronic intrusion.

7. The electronic control unit in accordance with claim 6, comprising:

said normal data comprises one or more of an amount of normal traffic, identification of normal messages, identification of normal vehicle device to device communication, and identification of normal sensor data.

8. The electronic control unit in accordance with claim 1, comprising:

said intrusion detection program comprises specification based anomaly detection to detect said one or more anomalies indicative of an electronic intrusion.

9. The electronic control unit in accordance with claim 8, comprising:

said intrusion detection program ignores all specification compliant data on said vehicle network bus and generates said alert indicative of an electronic intrusion for data on said vehicle network bus that is not specification compliant.

10. The electronic control unit in accordance with claim 9, comprising:

said electronic control unit transmits said alert indicative of an electronic intrusion to one of a display in said vehicle, a mobile device, and a server.

11. The electronic control unit in accordance with claim 10, wherein:

said vehicle network bus comprises a Controller Area Network (CAN) bus.

12. The electronic control unit in accordance with claim 8, comprising:

said specification-based anomaly detection is utilized to detect one or more of acceleration patterns, braking patterns, original equipment manufacturer (OEM) provided patterns, counterfeit airbags, spoofing of vehicle bus messages, spoofing of vehicle bus identifications, and invalid bus identifications.

13. The electronic control unit in accordance with claim 1, comprising:

an anomaly detection engine.

14. The electronic control unit in accordance with claim 13, comprising:

said anomaly detection engine comprises one of statistical anomaly detection and specification based anomaly detection.

15. The electronic control unit in accordance with claim 1, comprising:

said electronic control unit transmits said alert indicative of an electronic intrusion to one of a display in said vehicle, a mobile device, and a server.

16. The electronic control unit in accordance with claim 1, wherein:

said vehicle network bus comprises a Controller Area Network (CAN) bus.