VEHICLE CORRELATION SYSTEM FOR CYBER ATTACKS DETECTION AND METHOD THEREOF

• US 20170230385A1
• Filed: 09/21/2015
• Published: 08/10/2017
• Est. Priority Date: 09/25/2014
• Status: Active Grant

• Current Assignee: Tower-Sec Ltd.
• Original Assignee: Tower-Sec Ltd.
• Inventors: RUVIO, Guy, DICKMAN, Saar, WEISGLASS, Yuval, ETGAR, Yoav
• Granted Patent: US 10,516,681 B2
• Time in Patent Office: Days
• CPC Class Codes: B60R 25/30 Detection related to theft or to other events relevant to anti-theft systems
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 4/44 for communication between vehicles and infrastructures, e.g. vehicle-to-cloud [V2C] or vehicle-to-home [V2H]
• CPC Class Codes: H04W 84/18 Self-organising networks, e.g. ad-hoc networks or sensor networks

Abstract

A system and method for detection of at least one cyber-attack on one or more vehicles including steps of transmitting and/or receiving by a first on-board agent module installed within one or more vehicles and/or a second on-board agent module installed within road infrastructure and in a range of communication with said first on-board agent module metadata to and/or from an on-site and/or remote cloud-based detection server including a correlation engine; detecting cyberattacks based on correlation calculation between the metadata received from one or more first agent module installed within vehicles and/or from one or more second agent modules installed within road infrastructure; indicating a probability of a cyber-attack against one or more vehicle based on correlation calculation; initiating blocking of vehicle-to-vehicle communication to present and/or stop a spread of an identified threat.

Claims

1. A vehicle correlation system for detection of at least one cyber-attack on one or more vehicles comprising a plurality of on-board communication agent modules communicating with one another, said system comprising:

a. first on-board agent modules installed within a plurality of vehicles;

b. second on-board agent modules installed within road infrastructure and in a range of communication with at least one of said first on-board agent modules;

c. an on-site and/or remote cloud-based detection server comprising a correlation engine;

wherein said first agent modules and said at least one second agent module are operable to transmit and/or receive metadata to and/or from said correlation engine; and

said correlation engine is configured to indicate a probability of a cyberattack against one or more vehicles based on correlation calculation between said metadata received from one or more first agent modules installed within vehicles and/or from one or more second agent modules installed within road infrastructure;

further wherein said metadata comprises data parameters which correlate among one or more first agent modules installed within vehicles and/or from one or more second agent modules installed within road infrastructure are selected from a group consisting of;

a suspect and/or an identified threat on one or more vehicles, spread of a suspect and/or an identified attack among multiple vehicles, location of the vehicles, geographic information, vehicle unique identification, event time, vehicle-to-vehicle communication parameters, vehicle-to-infrastructure communication parameters, vehicle-to-cloud communication parameters, software applications downloaded and/or used in the vehicle and/or any combinations thereof.

4. The system according to claim 1, wherein the identified cyber-attacks compromise and/or intend to compromise vehicle functioning, vehicle safety, integrity of data transmitted from and/or to the vehicles.

5. The system according to claim 1, wherein spread of a suspect or an identified attack among multiple agents is correlated over time and/or location of the vehicles.

6. The system according to claim 1, wherein said metadata associated with cyber threats aggregated in said on-site and/or remote cloud-based detection server is transmitted from at least one said first agent module and/or at least one said second agent module.

7. The system according to claim 1, wherein said metadata associated with cyber threats aggregated in said on-site and/or remote cloud-based detection server is transmitted to at least one said first agent module and/or at least one said second agent module.

8. The system according to claim 1, wherein said correlation engine is configured to identify infection and spread of the identified cyber-attack based on vehicle-to-vehicle communication.

9. The system according to claim 1, wherein said correlation engine is configured to identify the pattern of the attack spread.

10. The system according to claim 4 and 5, wherein said server is configured to initiate blocking of vehicle-to-vehicle communication to prevent and/or stop a spread of an identified threat.

11. The system according to claim 4 and 5, wherein one or more first agent module installed within vehicles are operable to notify each other based on vehicle-to-vehicle communication of a suspect and/or an identified threat.

12. The system according to claim 1, wherein the location used for correlation calculation is based on cellular data and metadata.

13. The system according to claim 1, wherein geographic information used for correlation calculation is based on a third party geographic information system (GIS).

14. The system according to claim 11, wherein said geographic information system (GIS) contains city data.

15. The system according to claim 1, wherein said metadata is originated from an infotainment system.

16. The system according to claim 1, wherein said metadata is originated from the vehicles'"'"' sensors.

17. The system according to claim 1, wherein said metadata is originated from the vehicles'"'"' telematics systems.

18. The system according to claim 1, wherein said vehicles travel over air, land or sea.

22. The method according to claim 17, wherein the identified cyber-attacks compromise and/or intend to compromise vehicle functioning, vehicle safety, integrity of data transmitted from and/or to the vehicles.

23. The method according to claim 17, wherein spread of a suspect or an identified attack among multiple agents is correlated over time and/or location of the vehicles.

24. The method according to claim 17, wherein said metadata associated with cyber threats aggregated in said on-site and/or remote cloud-based detection server is transmitted from at least one said first agent module and/or at least one said second agent module.

25. The method according to claim 17, wherein said metadata associated with cyber threats aggregated in said on-site and/or remote cloud-based detection server is transmitted to at least one said first agent module and/or at least one said second agent module.

26. The method according to claim 17, wherein said method further comprises a step of identifying infection and spread of the identified cyber-attack based on vehicle-to-vehicle communication.

27. The method according to claim 17, wherein said method further comprises a step of identifying the pattern of the attack spread.

28. The method according to claim 22 and 23, wherein said method further comprises a step of initiating blocking of vehicle-to-vehicle communication to prevent and/or stop a spread of an identified threat.

29. The method according to claim 22 and 23, wherein said method further comprises a step of a one or more said first on-board agent modules installed within one or more vehicles notifying each other based on vehicle-to-vehicle communication of a suspect and/or an identified threat.

30. The method according to claim 17, wherein the location used for correlation calculation is based on cellular data and metadata.

31. The method according to claim 17, wherein geographic information used for correlation calculation is based on a third party geographic information system (GIS).

32. The method according to claim 27, wherein said geographic information system (GIS) contains city data.

33. The method according to claim 17, wherein said metadata is originated from an infotainment system.

34. The method according to claim 17, wherein said metadata is originated from the vehicles'"'"' sensors.

35. The method according to claim 17, wherein said metadata is originated from the vehicles'"'"' telematics systems.

36. The method according to claim 17, wherein said vehicles travel over air, land or sea.

2. (canceled)

3. (canceled)

19. A method for detection of at least one cyber-attack, said method comprising steps of:

a. transmitting and/or receiving by s-first on-board agent modules installed within vehicles and/or second on-board agent modules installed within road infrastructure and in a range of communication with at least one of said first on-board agent modules metadata to and/or from an on-site and/or remote cloud-based detection server comprising a correlation engine;

b. indicating a probability of cyberattacks based on correlation calculation between said metadata received from one or more first agent module installed within vehicles and/or from one or more second agent modules installed within road infrastructure;

further wherein said metadata comprises data parameters which correlate among one or more first agent modules installed within vehicles and/or from one or more second agent modules installed within road infrastructure are selected from a group consisting of;

a suspect and/or an identified threat on one or more vehicles, spread of a suspect and/or an identified attack among multiple vehicles, location of the vehicles, geographic information, vehicle unique identification, event time, vehicle-to-vehicle communication parameters, vehicle-to-infrastructure communication parameters, vehicle-to-cloud communication parameters, software applications downloaded and/or used in the vehicle and/or any combinations thereof.

20. (canceled)

21. (canceled)