Intrusion anomaly monitoring in vehicle environments

Abstract

A system for monitoring intrusion anomalies in a motor vehicle, the system comprising: at least one electronic control unit; at least one safety monitor, the at least one safety monitor being configured to detect intrusion anomalies of the at least one electronic control unit and output information related to the detected intrusion anomalies; and an anomaly analyzer, the anomaly analyzer being configured to: accumulate output information related to the detected intrusion anomalies; receive at least one vehicle status signal; in response to the received at least one vehicle status signal, compare the accumulated output information related to the detected intrusion anomaly with an abnormal event list, the abnormal event list including at least one abnormal event; and in response to a predetermined result of the comparison, output a predetermined event signal.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims priority to U.S. Provisional Patent Application S / N 62 / 877,962, filed on July 24, 2019, entitled “INTRUSION ANOMALY MONITORING INA VEHICLE ENVIRONMENT,” the entire contents of which are incorporated herein by reference. Technical Field

[0003] The present invention relates generally to the field of security devices, and more particularly to systems and methods for monitoring intrusion anomalies in an automotive environment. Background Art

[0004] The number of electronic devices installed in vehicles is increasing rapidly. In the past, electronic devices in cars were discrete devices that handled specific functions and operated in an independent environment. In the 1980s, the need to develop a network operating standard for vehicles was recognized, and the Controller Area Network (CAN) bus came into being.

[0005] Over time, the number of interconnected devices utilizing the CAN bus has increased rapidly. These interconnected devices can control driving features such as engine speed, brake control, and steering control, as well as comfort features such as lighting, window, and sunroof control.

[0006] A further development has been the expansion of the Internet, and the growing demand for wireless access to the Internet. The expansion of cellular telephones and wireless Internet access ensures that future vehicles will be connected to external networks. In the recent past, access to vehicles was limited to the use of dedicated service cables, and the only wireless access was radio for the delivery of news and music. Today, integrated infotainment systems are being provided to deliver both entertainment and information content to vehicles.

[0007] As the number of electronic devices in vehicles has doubled, many automakers have agreed on an open standard software architecture for automotive electronic control units (ECUs). Currently, the AUTOSAR Alliance in Munich, Germany has released version 4.3 of the Classic Platform for Automotive System Architecture. Automotive system architecture compliance diagnostics are designed to detect actual faults or defects in one or more ECUs. The diagnosis uses a specific communication protocol designated as "Diagnostics over Internet Protocol" (DoIP) or Unified Diagnostic Service (UDS), which is designed for communication between test equipment and ECUs via an on-board Ethernet switch. DoIP is a transparent protocol and does not involve conversion between test equipment and ECUs. DoIP is defined in Part 2 of ISO 13400, published by the International Organization for Standardization in Geneva, Switzerland. DoIP facilitates diagnostic-related communications between external test equipment and automotive ECUs. The diagnostic communication manager (DCM) within the ECU communicates with the test equipment, passing the relevant predefined diagnostic trouble code (DTC) defined by the automaker, which represents the detected fault in the corresponding ECU.

[0008] Despite the systems for generating and communicating detected faults in various ECUs, the prior art lacks a system to monitor and identify attacks by external attackers attempting to intrude into any part of the automotive communication network. This includes, but is not limited to: statistical anomalies in the data transmitted over the network, such as a distributed denial of service (DDOS) attack as described below; attempts to spoof the MAC address of the ECU; subscription requests from the IP of the port (PORT); incorrect values ​​in the SOME / IP information; signals that deviate from a predefined model or rule; stack overflows; and return-oriented programming attacks. In addition, no mechanism is provided for vehicle-to-vehicle DoIP communication, so vehicles cannot share DTCs with each other. Summary of the invention

[0009] Therefore, the main object of the present invention is to overcome at least some of the disadvantages of the prior art bus control methods and systems. This is provided in one embodiment by a system for monitoring intrusion anomalies in a motor vehicle, the system comprising: at least one electronic control unit; at least one safety monitor, the at least one safety monitor being configured to detect intrusion anomalies associated with the at least one electronic control unit and output information related to the detected intrusion anomalies; and an anomaly analyzer, the anomaly analyzer being configured to: accumulate output information related to the detected intrusion anomalies; receive at least one vehicle status signal; respond to the received at least one vehicle status signal; compare the accumulated output information related to the detected intrusion anomaly with an abnormal event list, the abnormal event list including at least one abnormal event; and respond to a predetermined result of the comparison, output a predetermined event signal.

[0010] In one embodiment, the anomaly analyzer is further configured to determine a vehicle state level, the vehicle state level being determined in response to a predetermined function of at least one received vehicle state signal, wherein the abnormal event list includes multiple sets of abnormal event list parameter values, the comparison is performed for multiple sets of abnormal event list parameter values, and wherein the abnormal event list parameter value is selected in response to the determined vehicle state level. In another embodiment, at least one security monitor is configured to detect an intrusion anomaly in response to a predetermined attribute of one or more messages not satisfying a predetermined verification parameter value, and wherein, in response to a predetermined result of the comparison, the anomaly analyzer is further configured to: generate an adjustment signal; and output the generated adjustment signal to the at least one security monitor, and the predetermined verification parameter value of the at least one security monitor is adjusted in response to the generated adjustment signal.

[0011] In one embodiment, the at least one received vehicle status signal includes at least one signal indicating a status of at least one internal system of the vehicle. In another embodiment, the at least one received vehicle status signal indicating a status of at least one internal system of the vehicle includes at least one signal indicating a status of: the speed of the vehicle; the steering wheel angle of the vehicle; the gear position of the vehicle; the brakes of the vehicle; the engine of the vehicle; or the position of the gyroscope of the vehicle.

[0012] In one embodiment, the at least one received vehicle status signal comprises at least one signal indicative of a status of an external environment of the vehicle. In another embodiment, the at least one received vehicle status signal comprises at least one signal indicative of a status of other vehicles surrounding the vehicle.

[0013] In one embodiment, the at least one vehicle status signal comprises a plurality of vehicle status signals. In another embodiment, the predetermined event signal comprises an alarm message.

[0014] In one embodiment, the system further comprises a communication control unit configured to control data communication with at least one electronic control unit, wherein the predetermined event signal comprises a command to disable a communication function of the communication control unit. In another embodiment, the system further comprises a communication control unit configured to control data communication with at least one electronic control unit, wherein at least one abnormal event comprises a plurality of abnormal events, the predetermined result of the comparison comprises identifying that the accumulated output information indicates the presence of one of the plurality of abnormal events, wherein, in response to a corresponding detected abnormal event of the plurality of abnormal events, the predetermined event signal is selected from the plurality of predetermined event signals, and wherein the plurality of predetermined event signals comprises: an alarm message; and a command to disable a communication function of the communication control unit.

[0015] In one embodiment, wherein the at least one electronic control unit comprises a plurality of electronic control units, and wherein the at least one safety monitor comprises a plurality of local safety monitors, each of the plurality of local safety monitors being associated with a respective one of the plurality of electronic control units.

[0016] In an independent embodiment, a method for monitoring an intrusion anomaly in a motor vehicle is provided, the method comprising: detecting an intrusion anomaly of at least one electronic control unit; outputting information related to the detected intrusion anomaly; accumulating the output information related to the detected intrusion anomaly; receiving at least one predetermined vehicle status signal; in response to at least one received vehicle status signal, comparing the accumulated output information with an abnormal event list, the abnormal event list including at least one abnormal event; and outputting a predetermined event signal in response to a predetermined result of the comparison.

[0017] In one embodiment, the method further comprises determining a vehicle state level, the vehicle state level being determined in response to a predetermined function of at least one received vehicle state signal, wherein the abnormal event list comprises a plurality of sets of abnormal event list parameter values, the comparison being performed for the plurality of sets of abnormal event list parameter values, and wherein the abnormal event list parameter values ​​are selected in response to the determined vehicle state level. In another embodiment, detecting an intrusion anomaly is in response to a predetermined attribute of one or more messages not satisfying a predetermined verification parameter value, and wherein, in response to a predetermined result of the comparison, the method further comprises: generating an adjustment signal; and outputting the generated adjustment signal, the predetermined verification parameter value being adjusted in response to the output adjustment signal.

[0018] In one embodiment, the at least one received vehicle status signal includes at least one signal indicating a status of at least one internal system of the vehicle. In another embodiment, the at least one received vehicle status signal indicating a status of at least one internal system of the vehicle includes at least one signal indicating a status of: the speed of the vehicle; the steering wheel angle of the vehicle; the gear position of the vehicle; the brakes of the vehicle; the engine of the vehicle; or the position of the gyroscope of the vehicle.

[0019] In one embodiment, the at least one received vehicle status signal comprises at least one signal indicative of a status of an environment external to the vehicle. In another embodiment, the at least one received vehicle status signal comprises at least one signal indicative of a status of other vehicles surrounding the vehicle.

[0020] In one embodiment, the at least one vehicle status signal comprises a plurality of vehicle status signals. In another embodiment, the predetermined event signal comprises an alarm message.

[0021] In one embodiment, the predetermined event signal includes a command to disable communication with at least one electronic control unit. In another embodiment, the at least one abnormal event includes a plurality of abnormal events, and the predetermined result of the comparison includes identifying that the accumulated output information indicates the presence of an abnormal event in the plurality of abnormal events, wherein, in response to a corresponding abnormal event in the plurality of detected abnormal events, the predetermined event signal is selected from the plurality of predetermined event signals, and wherein the plurality of predetermined event signals include: an alarm message; and a command to disable communication with at least one electronic control unit. Other features and advantages of the present invention will become apparent from the following drawings and description. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] For a better understanding of the invention and to show how the same may be practiced, reference will now be made, by way of example only, to the accompanying drawings in which like reference numerals refer to corresponding parts or elements throughout.

[0023] With specific reference now to the drawings, it is emphasized that the details shown are given only as examples and for the purpose of illustrative discussion of the preferred embodiments of the present invention, and are given in order to provide what is considered to be the most useful and easily understood description of the principles and conceptual aspects of the present invention. In this regard, no attempt is made to show more specific structural details of the present invention than is necessary for a basic understanding of the present invention, and the description in conjunction with the drawings makes it clear to those skilled in the art how several forms of the present invention may be implemented in practice. In the drawings:

[0024] Figures 1A to 1F illustrates a high-level block diagram of various embodiments of a system for monitoring an intrusion anomaly in a vehicle environment; and

[0025] Figure 2 A high-level flow chart of a method for monitoring a vehicle environment for intrusion anomalies according to certain embodiments is illustrated. DETAILED DESCRIPTION

[0026] Before describing in detail at least one embodiment of the present invention, it should be understood that the present invention is not limited in its application to the construction details and component arrangements set forth in the following description or illustrated in the accompanying drawings. The present invention may be applicable to other embodiments or may be practiced or implemented in various ways. In addition, it should be understood that the wording and terminology used herein are for description and should not be considered as limiting.

[0027] Figure 1A A high-level block diagram of a system 10 for monitoring an intrusion anomaly in a vehicle environment is illustrated. Figure 1B A high-level block diagram of a system 100 for monitoring intrusion anomalies is shown. Figure 1C A high-level block diagram of a system 200 for monitoring intrusion anomalies is shown. Figure 1DA high-level block diagram of a system 300 for monitoring intrusion anomalies is shown. Figure 1E A high-level block diagram of a system 400 for monitoring intrusion anomalies is illustrated, and Figure 1F High-level block diagrams of various portions of systems 10, 100, 200, and 300 are illustrated. Figures 1A to 1F are described together.

[0028] The system 10 includes: a plurality of ECUs 20, each ECU 20 including a corresponding safety monitor 30; and an abnormality analyzer 40. Each ECU 20 is illustrated as including a corresponding safety monitor 30, however this is not meant to be limiting in any way. In another embodiment, each safety monitor 30 is disposed outside the corresponding ECU 20 and communicates with the corresponding ECU 20. The abnormality analyzer 40 communicates with the safety monitor 30.

[0029] The system 100 includes: a plurality of ECUs 110; a safety monitor 120; and an abnormality analyzer 40. The safety monitor 120 communicates with the ECUs 110, and the abnormality analyzer 40 communicates with the safety monitor 110. The system 200 includes: a plurality of ECUs 20, each ECU 20 including a corresponding safety monitor 30; a plurality of ECUs 110; a safety monitor 120; and an abnormality analyzer 40. The safety monitor 120 communicates with the ECUs 110. The abnormality analyzer 40 communicates with the safety monitor 30 and the safety monitor 120 of the ECU 20.

[0030] The system 300 includes: an Ethernet switch / hub 310; a communication control unit 320; a communication control unit 330; a bus 340; a plurality of ECUs 350; a plurality of ECUs 360; and a security monitor 120. In one embodiment, the Ethernet switch / hub 310 is an Ethernet switch or an Ethernet hub. In another embodiment, the communication control unit 320 includes a smart antenna. In one embodiment, the communication control unit 320 includes a telematics control unit (TCU). In another embodiment, the communication control unit 320 includes a telematics box. In one embodiment, the communication control unit 320 includes a wireless data link, which can be implemented by a device compatible with Global System for Mobile Communications (GSM), Evolution Data Optimized (EV-DO), Wideband Code Division Multiple Access (W-CDMA), High Speed ​​Packet Access (HSPA), Worldwide Interoperability for Microwave Access (WIMAX), and / or Long Term Evolution (LTE), but is not limited thereto.

[0031] In one embodiment, the communication control unit 330 includes a gateway. In another embodiment, the communication control unit 330 includes a domain controller unit (DCU). In one embodiment, the bus 340 is a CAN bus. In yet another embodiment, the communication control unit 330 acts as a CAN gateway. Each of the communication control unit 320, the communication control unit 330, and the ECU 350 communicates with the Ethernet switch / hub 310. The bus 340 communicates with the communication control unit 330 and each of the ECU 360 communicates with the bus 340. In one embodiment, the safety monitor 120 communicates with the Ethernet switch / hub 310 and / or the communication control unit 330. In yet another embodiment, the safety monitor 120 is coupled to a corresponding port of the Ethernet switch / hub 310. In another embodiment (not shown), the safety monitor 120 is implemented in the Ethernet switch / hub 310, as shown in the system 400. In particular, except that the safety monitor 120 is implemented in the Ethernet switch / hub 310, the system 400 is similar to the system 300 in all aspects. In another embodiment (not shown), the security monitor 120 is implemented within the communication control unit 320. In another embodiment (not shown), the security monitor 120 is implemented within the communication control unit 330. The system 300 is illustrated in an embodiment in which a single security monitor 120 is provided, however this is not meant to be limiting in any way. In another embodiment, a plurality of security monitors 120 are provided, each communicating with and / or implemented within the Ethernet switch / hub 310, the communication control unit 320, and / or the communication control unit 330.

[0032] Systems 10, 100, 200, and 300 are illustrated and described in embodiments where the security monitors 30 and 120 are separate from the anomaly analyzer 40, however this is not meant to be limiting in any way. In another embodiment (not shown), the anomaly analyzer 40 and one or more security monitors 30 and / or 120 are implemented together as a single component, such as different code segments of a program.

[0033] The arrangement of systems 10, 100, 200 and 300 is not meant to be limiting, and other arrangements may be implemented, such as described in PCT publication WO 2019 / 142180, published on December 30, 2018, entitled “INTRUSION ANOMALY MONITORING IN A VEHICLE ENVIRONMENT,” the entire contents of which are incorporated herein by reference, and U.S. patent application publication S / N US 2019 / 0171813, published on June 6, 2019, entitled “Data Bus Protection Device and Method,” the entire contents of which are incorporated herein by reference.

[0034] In one embodiment, the anomaly analyzer 40 is located in the first vehicle and communicates with the safety monitor 30 and / or the safety monitor 120 of the second vehicle (not shown). In another embodiment, the anomaly analyzer 40 further communicates with an external anomaly monitor (not shown), optionally via a wireless Internet connection.

[0035] Figure 1F A high-level block diagram of a detailed implementation of the anomaly analyzer 40 is illustrated. In the illustrated implementation, the anomaly analyzer 40 includes: a communication node 400; a vehicle signal function 410; an anomaly function 420; an adjustment function 430; and a memory 440. Although the communication node 400, the vehicle signal function 410, the anomaly function 420, and the adjustment function 430 are described herein as separate components, this is not meant to be limiting in any way. In a specific implementation, the communication node 400, the vehicle signal function 410, the anomaly function 420, and the adjustment function 430 are each executed by a corresponding dedicated routine on a processor. In one implementation, the vehicle signal function 410 communicates with the Ethernet switch / hub 310 and / or the communication control unit 330. The anomaly analyzer 40 can be implemented in an FPGA, a microcontroller, or a processor with an associated memory that stores electronically readable instructions that perform the described tasks when implemented.

[0036] The anomaly analyzer 40 has stored therein a list of abnormal events. Optionally, the list of abnormal events is stored on the memory 440. The term "list" as used herein is not meant to limit the way in which the information of the abnormal event list is stored and arranged in any way. The abnormal event list includes at least one abnormal event, preferably a plurality of abnormal events. As used herein, the term abnormal event list refers to information related to predetermined attributes of at least one abnormal event. In one embodiment, the abnormal event list includes a list of rules, wherein the anomaly analyzer 40 compares different attributes of the received intrusion anomaly with a predetermined set of rules, as will be described below.

[0037] In one embodiment, Ethernet switch / hub 310 is programmed to transmit a copy of all messages passing through Ethernet switch / hub 310 to security monitor 120 so that security monitor 120 can see the messages for snooping.

[0038] In an embodiment where the security monitor 120 is implemented in the communication control unit 330 and the communication control unit 330 is implemented as a gateway, the Ethernet switch / hub 310 optionally forwards all or some packets to the gateway 330 for routing. In this case, in one embodiment, the security monitor 120 performs analysis on all packets or certain packets defined for inspection. In another embodiment, the Ethernet switch / hub 310 performs packet mirroring to copy the corresponding packets and send the copies to the security monitor 120.

[0039] In another embodiment, the Ethernet switch / hub 310 implements predefined security policies in hardware. For example, a ternary content addressable memory (TCAM) in a network device environment allows for efficient pattern matching of incoming packets with predefined patterns in hardware. Each of these predefined patterns can have configurable actions attached to it. If a TCAM hit occurs, meaning that the packet matches the predefined pattern, a defined action is performed for the corresponding packet. In one embodiment, the defined action includes:

[0040] 1. Discard the packet that generates a TCAM hit;

[0041] 2. Increment the counter;

[0042] 3. Change the physical destination port of the packet that generates the TCAM hit;

[0043] 4. Assigning packets that generate TCAM hits to QoS Class Identifier (QCI) flows; and / or

[0044] 5. Change the virtual local area network (VLAN) tag of the corresponding group.

[0045] Using these capabilities, the Ethernet switch / hub 310 is configured in such an embodiment to forward the defined packets for further analysis or for reporting to the security monitor 120. In another embodiment, as described above, the security monitor 120 is implemented within the Ethernet switch / hub 310. In such an embodiment, when a TCAM hit occurs, an intrusion anomaly is identified by the security monitor 120, and the security monitor 120 notifies the anomaly analyzer 40 of the intrusion anomaly, as will be described below.

[0046] In one non-limiting example, the predetermined rate limit is configured to the packet using the QCI flow concept, as described in the IEEE P802.1Qci standard, which is incorporated herein by reference in its entirety. In the event that the number of packets exceeds the predetermined rate limit, the security monitor 120 implemented in the internal CPU of the Ethernet switch / hub 310 reads the value of the defined register to detect whether the packet is discarded due to violation of the rate limit. The security monitor 120 in the internal CPU of the Ethernet switch / hub 310 then notifies the anomaly analyzer 40 of the intrusion anomaly.

[0047] In another non-limiting example, one of the TCAMs in the Ethernet switch / hub 310 is configured to change the packet destination in the case of an unallowed packet. In one embodiment, the new packet destination is the security monitor 120. In another embodiment as described above where the security monitor 120 is implemented within the Ethernet switch / hub 310, in response to a TCAM hit, the security monitor 120 detects this as an intrusion anomaly and outputs information related to the intrusion anomaly to the anomaly analyzer 40, as will be described below. In yet another embodiment, the security monitor 120 changes the packet destination of the packet to the anomaly analyzer 40, thereby providing the entire packet to the anomaly analyzer 40.

[0048] In another non-limiting example, one of the TCAMs in the Ethernet switch / hub 310 changes the VLAN ID to a unique ID that encodes information related to the detected intrusion anomaly. In such an embodiment, the anomaly analyzer 40 and / or the security monitor 120 are members of the VLAN ID and will receive the corresponding packets.

[0049] The systems 10, 100, 200, 300 are each illustrated in an embodiment in which the anomaly analyzer 40 communicates directly with the safety monitor 30 and / or the safety monitor 120, but this is not meant to be limiting in any way. In another embodiment (not shown), one or more additional components are provided, and the one or more additional components perform various communications between the safety monitor 30 or the safety monitor 120 and the anomaly analyzer 40, as will be described below. In particular, in one embodiment, a diagnostic communication manager (DCM) is provided, which performs communications between: the safety monitor 30 and / or the safety monitor 120; and the anomaly analyzer 40. The systems 10, 100, 200, 300 are each illustrated and described herein as including multiple ECUs, but this is not meant to be limiting in any way. In another embodiment (not shown), a single ECU 20, 110, 350 or 360 is provided. The operations of the systems 10, 100, 200 and 300 are described together.

[0050] Figure 2 A high-level flow chart of a method for monitoring a vehicle environment for intrusion anomalies according to certain embodiments is illustrated. Figure 2 The methods are described herein with respect to systems 10, 100, 200, and 300, however this is not meant to be limiting in any way, and Figure 2 The method may be implemented by any suitable system without going beyond the scope. In stage 1000, the security monitor 30 and / or the security monitor 120 detects an intrusion anomaly associated with the corresponding ECU 20, 110, 350 and 360. As used herein, the term "intrusion anomaly" is defined as an anomaly associated with an attacker's attempt to intrude into any part of the automotive communication network. This includes, but is not limited to: statistical anomalies in data transmitted over the network, such as distributed denial of service (DDOS) attacks; attempts to spoof the media access control (MAC) address of the ECU; subscription requests from the Internet Protocol (IP) address of the port; erroneous values ​​in the Scalable Service-Oriented Middleware (SOME / IP) information based on IP; signals that deviate from predefined models or rules; stack overflows; and return-oriented programming attacks.

[0051] In one embodiment, the security monitor 30 and / or the security monitor 120 monitor messages directed to the corresponding ECUs 20, 110, 350, and 360. In an embodiment of the system 300, the security monitor 120 optionally snoops or actively blocks messages addressed to the corresponding ECUs 350 and / or 360 by monitoring activity on the Ethernet switch / hub 310. In another embodiment, the security monitor 120 monitors messages directed to the bus 340. In another embodiment (not shown), one or more security monitors 30 and / or 120 monitor messages directed to the communication control unit 320 and / or the communication control unit 330 to determine intrusion anomalies directed to the communication control unit 320 and / or the communication control unit 330.

[0052] In one embodiment, at least one predetermined attribute of one or more messages is compared with the value of one or more predetermined verification parameters to identify intrusion anomalies. In yet another embodiment, a machine learning algorithm is used to compare the correlation of the signal with a predefined model. In the case where the signal deviates from the predefined model, an intrusion anomaly is detected. In one embodiment, each received message is snooped, and the source address and destination address of the snooped message are compared with a predetermined acceptable address list to determine the validity, that is, the predetermined attribute is the source address and the destination address and / or the port number. In particular, in an Ethernet packet, there is information related to the media access control (MAC) and Internet protocol (IP) addresses of the source and destination and the corresponding port numbers. In one embodiment, the corresponding security monitor 30 or 120 compares these addresses with a predetermined acceptable source and destination address list. In another embodiment, the corresponding security monitor 30 or 120 determines whether the IP and MAC addresses of the source belong to the same component. In another embodiment, the corresponding security monitor 30 or 120 determines whether the source with the corresponding IP address and port number is authorized to send data to the destination with the corresponding IP address and port number. In the event that any of the above addresses or address relationships are invalid, ie, at least one predetermined attribute of the message does not satisfy a valid value of a predetermined verification parameter, the message is determined to be an abnormal message and an intrusion anomaly is detected.

[0053] In another embodiment, each received message is snooped and the packets of the snooped messages are analyzed to determine any anomalies in the message. In yet another embodiment, the message is analyzed to determine whether the value in the message is valid for the corresponding destination, i.e., the predetermined attributes of the message are the corresponding value and the destination. For example, in a message for a steering wheel, the value for adjusting the steering wheel angle is only valid within a predetermined steering wheel angle range. In the event that the value exceeds the predetermined steering wheel angle range, the message is determined to be an abnormal message and an intrusion anomaly is detected.

[0054] In yet another embodiment, in a message consisting of a plurality of signals having a specific relationship therebetween, the corresponding safety monitor 30 or 120 determines whether the relationship is valid, that is, the predetermined attribute of the message is the relationship between the values ​​of the plurality of signals. For example, a message related to wheel speeds including four signals is received, the four signals being: signal a-right front wheel speed; signal b-left front wheel speed; signal c-left rear wheel speed; signal d-left rear wheel speed. In a non-limiting embodiment, in such an example, the payload of the message packet is 8 bytes and each signal includes 2 bytes of the packet. The corresponding safety monitor 30 or 120 determines, but is not limited to: the difference between the value of signal a and the value of signal b; the difference between the value of signal b and the value of signal c; and optionally, the difference between each of signals a, b, c and d. The corresponding safety monitor 30 or 120 compares the determined difference with one or more corresponding predetermined thresholds, that is, the value of the predetermined verification parameter is the corresponding threshold. In the case where the determined one or more differences are greater than one or more corresponding thresholds, the message is determined to be an abnormal message and an intrusion abnormality is detected.

[0055] In another embodiment, each received message is snooped, and the grouping of the snooped messages is statistically analyzed to determine any anomalies in the messages, i.e., the predetermined attribute is related to a plurality of received messages. In yet another embodiment, the predetermined attribute is the timestamp of the message and is related to a plurality of previously received messages. For example, the corresponding security monitor 30 or 120 determines how many messages have been received within a predetermined time interval. If the total number of messages received within a predetermined time interval or the number of messages addressed to a specific ECU 20, 110, 350 or 360, including the current message, is greater than a predetermined threshold, an intrusion anomaly is detected. In particular, the value of the predetermined verification parameter is a corresponding threshold value for the number of messages received within a predetermined time interval. As known to those skilled in the art, in the case of a denial of service attack, the total number of messages in any time interval will increase, and the corresponding security monitor 30 or 120 can detect such an attack.

[0056] In yet another embodiment, the predetermined attribute is the difference between the value of the payload signal of the first message and the value of the corresponding payload signal of the second message. For example, in an embodiment of the system 300, the first message sent to the bus 340 includes a signal of vehicle speed, and the second message sent to each ECU 350 includes a signal of an autonomous driving assistance system (ADAS). The safety monitor 120 determines the difference between the value of the corresponding signal of the first message and the value of the corresponding signal of the second message. In the case where the difference is greater than a predetermined threshold, the message is determined to be abnormal and an intrusion abnormality is detected.

[0057] In another embodiment, for periodic signals, that is, commands sent again and again to a specific system for correct operation, an anomaly is detected when the period changes. Specifically, if the period of the received message increases or decreases by more than a predetermined threshold, an intrusion anomaly is detected.

[0058] In one embodiment, each security monitor 30 and / or 120 further determines the severity of any detected intrusion anomaly according to one or more predetermined severity rules. In one embodiment, three different severity levels are assigned, however this is not meant to be limiting in any way. In another embodiment, the predetermined severity rules include, but are not limited to, one or more of the following: the difference between the command to a particular system and the current state of the system; the system that is the target of the anomaly message, i.e., anomaly messages for critical systems and safety systems will be assigned a higher severity level; and for periodic signals, the degree to which the period is disrupted.

[0059] In particular, in one embodiment, the difference between a command to a particular system and the current state of the system is measured by comparing the future state of the system after executing the command with the current state of the system. For example, the speed that a vehicle will reach after receiving a particular command is compared with the current speed of the vehicle. If the command has been detected as an intrusion anomaly, a larger difference will increase the severity of the anomaly and a higher severity level will be assigned. In one embodiment, for periodic signals, i.e., commands sent again and again to a particular system for correct operation, an intrusion anomaly is detected when the period changes, as described above. Specifically, if the period of the received message increases or decreases by more than a predetermined threshold, an intrusion anomaly is detected. The distance of the period distance from the predetermined threshold determines the severity. If the distance is larger, the severity level is higher. If the distance is smaller, the severity level is lower.

[0060] In one embodiment, higher values ​​are assigned to higher severity levels and lower values ​​are assigned to lower severity levels, however this is not meant to be limiting in any way. Although the above has been described with respect to an embodiment where the severity is determined by the security monitor 30 and / or 120, this is not meant to be limiting in any way. In another embodiment, the anomaly analyzer 40 determines the severity of the intrusion anomaly in cooperation with the security monitor 30 and / or 120 or independently.

[0061] In stage 1010, the security monitor 30 and / or 120 outputs information related to the detected intrusion anomaly of stage 1000 to the anomaly analyzer 40. In one embodiment, the output information is transmitted using: Diagnosis over Internet Protocol (DoIP); Transmission Control Protocol (TCP); Unified Diagnostic Service (UDS) and / or User Datagram Protocol (UDP).

[0062] In one embodiment, the security monitor 30 and / or 120 generates a diagnostic exception code (DAC) to include information related to the detected intrusion exception. As used herein, the term DAC means a code indicating an exception that deviates from the correct configuration. In contrast to DTC, DAC provides an exception code for complex anomalies, such as security holes, security holes, and hacker identification, as will be further described below. For example, if a DDOS attack is detected, this attack will not constitute an exception associated with a standard DTC because each access attempt is correct. Only when the accumulation of access attempts is detected, the security monitor 30 and / or 120 detects a DDOS attack and generates an appropriate DAC. In addition, DTC is usually limited in size and generally only contains 2 bytes of data, while DAC can be larger and contain more data, as will be described below.

[0063] In one embodiment, each DAC indicates a corresponding intrusion anomaly. In another embodiment, the same DAC is generated for each intrusion anomaly, and the payload of the DAC carries information indicating the corresponding intrusion anomaly detected. In one embodiment, the security monitor 30 and / or 120 outputs the relevant information to a diagnostic event manager (DEM), and the DEM (not shown) generates the corresponding DAC. In one embodiment, the output information includes: the type of intrusion anomaly; the severity of the intrusion anomaly; and any other relevant information.

[0064] In one embodiment, the safety monitor 30 and / or 120 stores information related to the detected intrusion anomalies on a corresponding memory (not shown). In another embodiment, the anomaly analyzer 40 periodically requests information related to all detected intrusion anomalies. In yet another embodiment, without receiving a request from the anomaly analyzer 40, the safety monitor 30 and / or 120 periodically transmits the stored information to the anomaly analyzer 40 at predetermined time intervals or in response to predetermined rules. In yet another embodiment, the predetermined rules include: transmitting information once at least a predetermined number of intrusion anomalies have been detected; transmitting information once at least a predetermined number of intrusion anomalies with a severity of a predetermined value have been detected; and / or transmitting information once at least a predetermined number of intrusion anomalies associated with at least a predetermined number or type of ECUs 20, 110, 350, and / or 360 have been detected. In another embodiment, the information related to the detected intrusion anomalies is transmitted together with any DTC associated with the ECU 20, 110, 350, and / or 360. In another embodiment, information related to each detected intrusion anomaly is transmitted to an anomaly analyzer when a corresponding intrusion anomaly is detected.

[0065] In one non-limiting embodiment, the output message including information for each corresponding intrusion anomaly includes the following fields: message length, optionally a message length of 1 byte in size; a message identifier, optionally a message identifier of 4 bytes in size; anomaly type, optionally an anomaly type of 1 byte in size; anomaly subtype, optionally an anomaly subtype of 1 byte in size; a determined anomaly severity, optionally a determined anomaly severity of 1 byte in size; a first value field, optionally a first value field of 1 byte in size; and an optional second value field, optionally a second value field of 4 bytes in size.

[0066] For example, for an exception indicating that the value of the steering wheel angle is 10 degrees greater than the maximum value of the predetermined valid angle range, and the severity of the exception is 2, the message is optionally as follows:

[0067]

[0068] "x" is the ID of the message.

[0069] In such an example, the second value field is not used. In another example, for an exception indicating that the difference between the value of signal "a" and the value of signal "b" is greater than a predetermined threshold and the severity is 3, the message is optionally as follows:

[0070]

[0071]

[0072] In such an example, the second value field is used to transmit the actual signal value as well as the actual deviation value. In the case where the same message additionally contains signals "c" and "d", as described above, the message is optionally as follows:

[0073]

[0074] Therefore, 2 DAC messages are sent for the same message.

[0075] In another example, where an invalid MAC address is detected, as described above, the message is optionally as follows:

[0076]

[0077] The MAC address is 6 bytes long, and the first value field is only 2 bytes long, so the second value field is also used for the MAC address. As mentioned above, a possible invalidity is the case where the source with the corresponding MAC address is not authorized to send a message to the corresponding destination with the corresponding IP address. Therefore, the exception subtype is a mismatch between the MAC and IP addresses.

[0078] In another example, for an exception of a mismatch of values ​​between two messages, as described above, the message is optionally as follows:

[0079]

[0080]

[0081] Although the above examples illustrate an implementation where the message has a length of 15 bytes, this is not meant to be limiting in any way, and messages with various lengths may be generated. Although the above examples illustrate an implementation where relevant information about an anomaly is transmitted in a single message, this is not meant to be limiting in any way, and multiple messages may be generated for each detected intrusion anomaly.

[0082] In stage 1020, the anomaly analyzer 40 accumulates the received output information of stage 1010 related to the detected intrusion anomaly. Optionally, the received information is stored on the memory 440. In stage 1030, the anomaly analyzer 40 receives at least one vehicle status signal. In one embodiment, the at least one vehicle status signal is received by the vehicle signal function 410. In another embodiment, the at least one vehicle status signal is received from the Ethernet switch / hub 310 and / or the communication control unit 330. As used herein, the term "vehicle status signal" is defined as a signal indicating the current state of a particular system of the vehicle and / or a signal indicating a condition outside the vehicle. Specifically, in one embodiment, the at least one vehicle status signal includes, but is not limited to: the speed of the vehicle; the angle of the steering wheel relative to the initial position; which gear the vehicle is in; the position of the brake; the state of the engine of the vehicle, such as the number of revolutions per minute (RPM); and / or the position of the gyroscope of the vehicle relative to the initial position. In yet another embodiment, the at least one vehicle status signal also includes environmental conditions, such as predetermined attributes of the weather, the amount of lighting outside the vehicle, and / or the type or condition of the road on which the vehicle is traveling. These signals are received from dedicated sensors of the vehicle and / or from external sources such as the Internet. In another embodiment, at least one vehicle status signal also includes the status of surrounding vehicles, such as the distance to the nearest vehicle, the speed of surrounding vehicles and / or the angular momentum of surrounding vehicles. These signals are received from radar systems and / or via vehicle-to-vehicle (V2V) communications.

[0083] In yet another embodiment, the at least one vehicle state signal is associated with a corresponding predetermined threshold. In one example, the speed of the vehicle is compared to a predetermined speed threshold, and it is determined whether the vehicle speed is greater than the predetermined speed threshold or less than the predetermined speed threshold. In another example, the angle of the steering wheel relative to the initial position is compared to a predetermined angle threshold, and it is determined whether the steering wheel angle is greater than the predetermined angle threshold or less than the predetermined angle threshold.

[0084] In another example, the current gear of the vehicle is compared with a predetermined gear threshold, and it is determined whether the current gear of the vehicle is greater than the predetermined gear threshold or less than the predetermined gear threshold. In another example, the position of the brake is compared with a predetermined braking threshold, and it is determined whether the current brake position is greater than the predetermined braking threshold or less than the predetermined braking threshold. In one non-limiting embodiment, the predetermined braking threshold is given by:

[0085] BTH=|MAX-MIN| / 2 Equation 1 Among them, MAX is the position of the brake when the brake is fully pressed, and MIN is the position of the brake when the brake is not pressed.

[0086] In another example, the RPM of the engine is compared to a predetermined RPM threshold, and it is determined whether the current RPM value is greater than the predetermined RPM threshold or less than the predetermined RPM threshold. In another example, the position of the gyroscope relative to the initial position is compared to a predetermined gyroscope threshold, and it is determined whether the current gyroscope position value is greater than the predetermined gyroscope threshold or less than the predetermined gyroscope threshold.

[0087] In one embodiment, the comparison with the predetermined threshold is performed by the vehicle signal function 410. In another embodiment, the comparison is performed by other systems in the vehicle, and the relative values ​​of the vehicle status signals - that is, the relationship of each system to the corresponding predetermined value - are received by the vehicle signal function 410. For example, a dedicated system external to the anomaly analyzer 40 determines whether the vehicle is traveling at a high speed or a low speed, and the vehicle signal function 410 receives a corresponding signal indicating whether the vehicle speed is high or low.

[0088] In optional stage 1040, the abnormality analyzer 40 further determines the grade of each received at least one vehicle status signal in response to one or more predetermined classification rules. Optionally, the grade is determined by the vehicle signal function 410. In a non-limiting embodiment, when the corresponding vehicle status signal value is equal to 0, a first grade value is assigned. In such an embodiment, when the corresponding vehicle status signal value is greater than zero but less than a corresponding predetermined threshold, a second grade value is assigned. For example, if the speed of the vehicle is greater than zero, but less than a predetermined speed threshold, the second grade value is assigned to the vehicle speed. In addition, when the corresponding vehicle status signal value is greater than or equal to the corresponding predetermined threshold, a third grade value is assigned.

[0089] In optional stage 1050, the overall grade of the current vehicle state is determined by the anomaly analyzer, optionally by the vehicle signal function 410, in response to the at least one vehicle state signal received in stage 1030 and a predetermined classification rule. In one embodiment, the predetermined classification rule is given by:

[0090] TG=f(speed_g, angle_g, gear_g, brake_g, engine_g, gyro_g) Equation 2

[0091] Wherein TG is the overall level of the current vehicle state, speed_g is the vehicle speed level of the optional stage 1030, angle_g is the steering wheel angle level, gear_g is the gear level, brake_g is the brake level, engine_g is the engine state level, and gyro_g is the gyroscope state level, as described above. f is a function preferably defined by the original equipment manufacturer (OEM). In yet another non-limiting embodiment, the overall level is defined as:

[0092] TG=w1*(spe|ed_g)+w2*(angle_g)+w3*(gear_g)+w4*(brake_g)+w5*(engine_g)+w6*(gyro_g) Equation 3

[0093] Among them, w1 is the predetermined weight of the vehicle speed level of the optional stage 1040, w2 is the predetermined weight of the steering wheel angle level of the optional stage 1040, w3 is the predetermined weight of the gear state level of the optional stage 1040, w4 is the predetermined weight of the brake state level of the optional stage 1040, w5 is the predetermined weight of the engine state level of the optional stage 1040, and w6 is the predetermined weight of the gyroscope state level of the optional stage 1040.

[0094] As described above, in one embodiment, at least one vehicle status signal also includes environmental conditions and / or the status of surrounding vehicles. In such an embodiment, equation 2 also includes these signals, which are optionally graded, as described above for optional stage 1040. Thus, a more accurate indication of the level of danger to which the vehicle is exposed is achieved.

[0095] Although optional stages 1040 to 1050 have been described with respect to an embodiment in which a grade is assigned to a received vehicle status signal, this is not meant to be limiting in any way. In another embodiment, an alternative method may be used that utilizes information from a received vehicle status signal without assigning an actual grade value.

[0096] In optional stage 1060, the anomaly analyzer 40, optionally via the anomaly function 420, determines the duration of each anomaly, ie the number of anomaly messages of the respective system within a predetermined period of time.

[0097] In stage 1070, the anomaly analyzer 40 compares the accumulated output information of the detected intrusion anomaly of stage 1020 with the abnormal event list in response to the at least one vehicle status signal received of stage 1030. As described above, in one embodiment, the abnormal event list is stored on the memory 440. Optionally, the comparison is performed by the abnormal function 420.

[0098] The comparison is not meant to be limited to a direct item-by-item comparison, and the identification of a range of values ​​or the conversion of values ​​may be used without exceeding the range and in accordance with one or more predetermined abnormal event list rules. In a specific embodiment, each abnormal event in the abnormal event list includes a set of predetermined parameters, such that an abnormal event is detected when the predetermined attributes of one or more detected intrusion anomalies satisfy the values ​​of the corresponding parameters. In one embodiment, the predetermined rule set includes a plurality of predetermined parameters, the plurality of predetermined parameters including, but not limited to: the number of detected anomalies received; the severity of the detected anomalies; the duration of the detected anomalies, as described above; and / or the number of ECUs targeted by the detected anomalies. In one embodiment, the severity and / or duration are determined in relation to the anomaly with the highest severity and the longest duration, respectively. In another embodiment, the severity and / or duration are determined relative to a predetermined number or percentage of detected anomalies.

[0099] For example, the anomaly analyzer 40 checks that there are no more than 2 anomalies with a severity level greater than 2, etc. In one embodiment, each rule set on the abnormal event list has an associated flag indicating whether an alarm indicator is sent and / or whether communication is disabled. In an alternative embodiment, multiple abnormal event lists are provided, each abnormal event list having one or more associated actions. In another embodiment, the associated action is responsive to a specific type or types of detected anomalies.

[0100] In addition, as described above, the comparison with the abnormal event list is further performed for the at least one vehicle state signal received in phase 1030. In particular, in one embodiment, the comparison is performed for the determined overall grade TG of the vehicle state, as described above with respect to equation 2. In yet another embodiment, the parameter values ​​of the predetermined events of the abnormal event list are determined according to the value of the overall grade.

[0101] Non-limiting examples of multiple abnormal events in the abnormal event list are given in Table 1:

[0102] Table 1

[0103]

[0104]

[0105] TG1 and TG2 are different total levels TG, where TG2 is greater than TG1. t1 is a predetermined duration threshold. The abnormal events in this example are defined by different rule sets according to the corresponding level TG. If the detected anomaly received meets the parameter value of the rule set, it is determined that an abnormal event has occurred. As shown in Table 1, there are different rule sets for different levels TG. For example, as shown above, if the total level TG is large, a larger number of types and / or anomalies are required to identify abnormal events. This is because the higher the total level TG, the more dangerous the vehicle is, so the rule set is set to reduce the number of false alarms. However, this does not mean that it is limited in any way, and different rule sets are associated with different corresponding total levels TG according to any predetermined associated rules. For example, for anomalies with higher severity, a higher total level TG requires fewer anomalies in order to quickly respond to anomalies that are obvious and may quickly lead to dangerous situations for the vehicle, as described in rule set 3.

[0106] In one example, when a total of 2 messages are received:

[0107]

[0108] as well as

[0109]

[0110] For the total vehicle level TG1, the intrusion anomaly satisfies all parameters of the abnormal event list because the intrusion anomaly meets the conditions of rule set 1, that is, there are 2 different types of anomalies and the severity is greater than 2.

[0111] However, the following exceptions will not satisfy the parameters of the exception event list, that is, the following exceptions will not satisfy the conditions of any rule set:

[0112]

[0113] as well as

[0114]

[0115] Although there are 2 anomalies with severity greater than 2, the anomalies are of the same type and therefore do not satisfy the conditions of Rule Set 1, Rule Set 2, or Rule Set 3.

[0116] Although the above description has been made on the types of anomalies, this is not meant to be limiting in any way. In another embodiment, the rule set of the abnormal event list includes conditions related to the subtype of the anomaly in addition to the conditions related to the type of the anomaly.

[0117] In stage 1080, in response to a predetermined result of the comparison of stage 1070, the anomaly analyzer 40 outputs at least one predetermined event signal. The predetermined event signal includes an indication that an abnormal event has been detected. In one embodiment, in response to a first result of the comparison of stage 1070, a predetermined event signal is output, and in response to a second result of the comparison of stage 1070, a predetermined event signal is not output. The first result is a determination that an abnormal event has been detected, and the second result is a determination that no abnormal event has been detected. In the above embodiment in which the comparison determines whether the predetermined attributes of each intrusion anomaly meet the values ​​of the predetermined parameters of the abnormal events in the abnormal event list, the first result of the comparison is a determination that the predetermined attributes of each intrusion anomaly meet the values ​​of the predetermined parameters of the abnormal event, and the second result of the comparison is a determination that the predetermined attributes of each intrusion anomaly do not meet the values ​​of the predetermined parameters of the abnormal event.

[0118] In one embodiment, the predetermined event signal is selected from a plurality of predetermined event signals. The plurality of predetermined event signals include: an alarm message; and a command to disable communication with ECU 20, 110, 350 and / or 360 within a predetermined time interval. In one embodiment, disabling the communication includes disabling the communication function of the communication control unit 320 or the communication control unit 330. In yet another embodiment, the alarm message is transmitted to a server. In another embodiment, the alarm message is displayed to the driver of the vehicle. Optionally, the displayed alarm message may prompt the driver to pull over. Further optionally, in an autonomous vehicle, the alarm message may cause the car to pull over. In one embodiment, the command to disable the communication function of the communication control unit 320 or the communication control unit 330 may be executed by utilizing a unified diagnostic service (UDS) protocol message as defined in ISO 14229-1. In this particular embodiment, the anomaly analyzer 40 uses a service 0x31 request on the UDS with the communication control unit 320 or the communication control unit 330 as the target of the message to modify the state of the communication control unit 320 or the communication control unit 330 to block any incoming requests.

[0119] In one embodiment, in response to a corresponding detected abnormal event among the plurality of abnormal events, a predetermined event signal is selected from the plurality of event signals, i.e., for each detected abnormal event, a different predetermined event signal is selected. In another embodiment, an alarm message is always generated and a command to disable the communication function of the communication control unit 320 or the communication control unit 330 is generated only in response to: certain predetermined abnormal events are detected; and / or at least one received vehicle signal satisfies one or more predetermined parameters, such as a predetermined vehicle grade.

[0120] In optional stage 1090, in response to the detected abnormal event of stage 1080, the abnormality analyzer 40 and its optional adjustment function 430 generate an adjustment signal, which is output to one or more of the following: ECU20, 110, 350 or 360; security monitor 30 and / or 120; or communication control unit 320 and / or 330. In response to the generated adjustment signal, future abnormality identification is performed according to the adjusted set of verification values. In particular, as described above, the abnormality is detected in response to a predetermined set of abnormal rules. If an abnormal event has been detected, a stricter set of abnormal rules is used because the security risk has increased. For example, if a denial of service attack has been detected, the generated adjustment signal causes the security monitor 30 and / or 120 to adjust the corresponding verification value so that the number of messages that trigger abnormality detection within a predetermined time interval is reduced.

[0121] It should be understood that certain features of the invention described in the context of separate embodiments for the sake of clarity may also be provided in combination in a single embodiment. Conversely, various features of the invention described in the context of a single embodiment for the sake of brevity may also be provided separately or in any suitable sub-combination. In particular, the present invention has been described as each electrical device being identified by class, however this is not meant to be limiting in any way. In alternative embodiments, all electrical devices are treated equally, so there is no need to identify the class and its associated power requirements.

[0122] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which the invention belongs. Although methods similar or equivalent to those described herein can be used in the practice or testing of the present invention, suitable methods are described herein.

[0123] All publications, patent applications, patents, and other references mentioned herein are incorporated by reference in their entirety. In the event of a conflict, the patent specification, including definitions, shall prevail. In addition, the materials, methods, and examples are illustrative only and are not intended to be limiting.

[0124] It will be understood by those skilled in the art that the present invention is not limited to what has been specifically shown and described above. On the contrary, the scope of the present invention is defined by the appended claims and includes the combinations and sub-combinations of the various features described above and variations and modifications that will occur to those skilled in the art after reading the above description.

Claims

1. A system for monitoring an intrusion anomaly in a motor vehicle, the system comprising: at least one electronic control unit; at least one security monitor configured to detect an intrusion anomaly associated with the at least one electronic control unit and output information related to the detected intrusion anomaly; as well as An exception analyzer, wherein the exception analyzer is configured to: accumulating the output information related to the detected intrusion anomaly; receiving at least one vehicle status signal; determining a vehicle status level, the vehicle status level being determined in response to a predetermined function of the received at least one vehicle status signal; In response to the received at least one vehicle status signal, comparing the accumulated output information related to the detected intrusion anomaly with an abnormal event list, the abnormal event list including information related to predetermined attributes of at least one abnormal event; as well as outputting a predetermined event signal in response to a predetermined result of the comparison, The abnormal event list includes multiple abnormal events, each abnormal event includes multiple groups of abnormal event list parameter values, and each group of abnormal event list parameter values ​​includes multiple abnormal event list parameter values. Wherein, the comparison includes: Based on the determined vehicle status level, selecting one of a plurality of abnormal events; and The accumulated output information related to the detected intrusion anomaly is compared with each of the plurality of sets of abnormal event list parameter values ​​for the selected abnormal event.

2. The system according to claim 1, wherein: The at least one security monitor is configured to detect the intrusion anomaly in response to a predetermined attribute of one or more messages not satisfying a predetermined verification parameter value, and Wherein, in response to the predetermined result of the comparison, the abnormality analyzer is further configured to: generating an adjustment signal; and The generated adjustment signal is output to the at least one safety monitor, and the predetermined verification parameter value of the at least one safety monitor is adjusted in response to the generated adjustment signal.

3. The system according to any one of claims 1 to 2, wherein: The at least one received vehicle status signal includes at least one signal indicative of a status of at least one internal system of the vehicle.

4. The system according to claim 3, wherein: The received at least one vehicle status signal indicative of a status of at least one internal system of the vehicle comprises at least one signal indicative of a status of: the speed of the vehicle; a steering wheel angle of the vehicle; the gear position of the vehicle; brakes of the vehicle; the engine of the vehicle; or The position of the vehicle's gyroscope.

5. The system according to any one of claims 1 to 2, wherein: The at least one received vehicle status signal includes at least one signal indicative of a status of an environment external to the vehicle.

6. The system according to any one of claims 1 to 2, wherein: The at least one received vehicle status signal includes at least one signal indicative of a status of other vehicles surrounding the vehicle.

7. The system according to any one of claims 1 to 2, wherein: The at least one vehicle status signal includes a plurality of vehicle status signals.

8. The system according to any one of claims 1 to 2, wherein: The predetermined event signal comprises an alarm message.

9. The system according to any one of claims 1 to 2, further comprising a communication control unit arranged to control data communication with the at least one electronic control unit, in, The predetermined event signal includes a command to disable a communication function of the communication control unit.

10. The system according to any one of claims 1 to 2, further comprising a communication control unit arranged to control data communication with the at least one electronic control unit, in, The predetermined result of the comparison includes identifying that the accumulated output information indicates the presence of one of the plurality of abnormal events, wherein, in response to the corresponding detected abnormal event among the plurality of abnormal events, the predetermined event signal is selected from a plurality of predetermined event signals, and Wherein, the plurality of predetermined event signals include: Alert messages; and A command to disable the communication function of the communication control unit.

11. The system according to any one of claims 1 to 2, wherein: The at least one electronic control unit comprises a plurality of electronic control units, and Wherein, the at least one safety monitor comprises a plurality of local safety monitors, each of the plurality of local safety monitors being associated with a corresponding one of the plurality of electronic control units.

12. A method of monitoring an intrusion anomaly in a motor vehicle, the method comprising: detecting an intrusion anomaly associated with at least one electronic control unit; Outputting information related to the detected intrusion anomaly; accumulating the output information related to the detected intrusion anomaly; receiving at least one predetermined vehicle status signal; determining a vehicle status level, the vehicle status level being determined in response to a predetermined function of the received at least one vehicle status signal; In response to the received at least one vehicle status signal, comparing the accumulated output information to an abnormal event list, the abnormal event list including information related to predetermined attributes of at least one abnormal event; as well as outputting a predetermined event signal in response to a predetermined result of the comparison, The abnormal event list includes multiple abnormal events, each abnormal event includes multiple groups of abnormal event list parameter values, and each group of abnormal event list parameter values ​​includes multiple abnormal event list parameter values. Wherein, the comparison includes: Based on the determined vehicle status level, selecting one of a plurality of abnormal events; and The accumulated output information related to the detected intrusion anomaly is compared with each of the plurality of sets of abnormal event list parameter values ​​for the selected abnormal event.

13. The method according to claim 12, wherein: The detecting of the intrusion anomaly is responsive to a predetermined attribute of one or more messages not satisfying a predetermined verification parameter value, and Wherein, in response to the predetermined result of the comparison, the method further comprises: generating an adjustment signal; and The generated adjustment signal is output, and the predetermined verification parameter value is adjusted in response to the output adjustment signal.

14. The method according to any one of claims 12 to 13, wherein: The at least one received vehicle status signal includes at least one signal indicative of a status of at least one internal system of the vehicle.

15. The method according to claim 14, wherein: The received at least one vehicle status signal indicative of a status of at least one internal system of the vehicle comprises at least one signal indicative of a status of: the speed of the vehicle; a steering wheel angle of the vehicle; the gear position of the vehicle; brakes of the vehicle; the engine of the vehicle; or The position of the vehicle's gyroscope.

16. The method according to any one of claims 12 to 13, wherein: The at least one received vehicle status signal includes at least one signal indicative of a status of an environment external to the vehicle.

17. The method according to any one of claims 12 to 13, wherein: The at least one received vehicle status signal includes at least one signal indicative of a status of other vehicles surrounding the vehicle.

18. The method according to any one of claims 12 to 13, wherein: The at least one vehicle status signal includes a plurality of vehicle status signals.

19. The method according to any one of claims 12 to 13, wherein: The predetermined event signal comprises an alarm message.

20. The method according to any one of claims 12 to 13, wherein: The predetermined event signal includes a command to disable communication with the at least one electronic control unit.

21. The method according to any one of claims 12 to 13, in, The predetermined result of the comparison includes identifying that the accumulated output information indicates the presence of one of the plurality of abnormal events, wherein, in response to the corresponding detected abnormal event among the plurality of abnormal events, the predetermined event signal is selected from a plurality of predetermined event signals, and Wherein, the plurality of predetermined event signals include: Alert messages; and A command to disable communications with the at least one electronic control unit.

Images