Systems and methods for detecting abnormal behavior at an autonomous driving system

Abstract

An autonomous driving system (ADS) for an autonomous vehicle includes a communication module, a perception module, an anomalous behavior detection module, and a processor. The communication module is configured to receive a vehicle-to-vehicle (V2V) message including message-based vehicle data. The perception module is configured to receive sensor data from at least one vehicle sensing device. The anomalous behavior detection module is configured to determine whether the V2V message is a legitimate message or a malicious message based at least in part on a comparison of the message-based vehicle data to sensor-based vehicle data generated based on the sensor data. The processor is configured to manage performance of the autonomous vehicle based on the determination based on the message-based vehicle data. Other embodiments are described and claimed.

Description

Technical Field

[0001] This technical field generally relates to autonomous vehicles, and more specifically to systems and methods for detecting malicious vehicle-to-vehicle (V2V) messages at an autonomous driving system. Background Technology

[0002] Automated vehicles are typically configured to receive vehicle-to-vehicle (V2V) messages from other automated vehicles. V2V messages include vehicle identifiers and vehicle data associated with the sending vehicle. The automated driving system (ADS) of an automated vehicle typically relies on the vehicle data contained in the V2V messages received from other automated vehicles to correctly guide and navigate the vehicle.

[0003] Malicious entities can send seemingly legitimate V2V messages to autonomous vehicles via wireless communication channels. The malicious entity may attempt to impersonate another, non-existent, autonomous vehicle. This non-existent vehicle can be a ghost vehicle. The malicious V2V message may include malicious vehicle data associated with the ghost vehicle.

[0004] An Adaptive Controller (ADS) within an autonomous vehicle might perform one or more actions based on malicious vehicle data received in malicious V2V messages. These actions could reduce traffic-related guidance efficiency or enable maneuvers to avoid non-existent ghost vehicles that could potentially cause accidents. It would be beneficial if the ADS could identify malicious V2V messages to avoid using malicious vehicle data that could impair its ability to properly guide and navigate the autonomous vehicle. Summary of the Invention

[0005] In one embodiment, the autonomous driving system (ADS) of an autonomous vehicle includes an abnormal behavior detection system. The ADS includes a communication module, a perception module, an abnormal behavior detection module, and a processor. The communication module is configured to receive vehicle-to-vehicle (V2V) messages that include message-based vehicle data. The perception module is configured to receive sensor data from at least one vehicle sensing device. The abnormal behavior detection module is configured to determine, at least in part, whether a V2V message is legitimate or malicious based on a comparison between the message-based vehicle data and sensor-based vehicle data generated from the sensor data. The processor is configured to manage the performance of the autonomous vehicle based on the determination result and the message-based vehicle data.

[0006] In one embodiment, message-based vehicle data includes the vehicle location of the source vehicle in the V2V message, and sensor-based vehicle data includes the sensor-based vehicle location of the source vehicle based on sensor data.

[0007] In one embodiment, the abnormal behavior detection module is configured to determine whether a V2V message is a legitimate message or a malicious message based at least in part on performing a trustworthiness check on message-based vehicle data.

[0008] In one embodiment, the message-based vehicle data includes the vehicle location of the source vehicle in the V2V message, and the abnormal behavior detection module is configured to determine whether the vehicle location of the source vehicle is within a sensor detection area associated with at least one vehicle sensing device, and to perform a sensor operation check on the at least one vehicle sensing device based on the determination result.

[0009] In one embodiment, the vehicle-based data based on the message includes the vehicle location of the source vehicle of the V2V message, and the abnormal behavior detection module is configured to determine whether the vehicle location of the source vehicle is within a sensor detection area associated with at least one vehicle sensing device, and to compare the vehicle location of the source vehicle received in the V2V message with historical source vehicle location data to identify whether the V2V message is a legitimate message or a malicious message based on the determination result.

[0010] In one embodiment, the vehicle-based data based on the message includes the vehicle location of the source vehicle of the V2V message, and the abnormal behavior detection module is configured to determine whether the vehicle location of the source vehicle is within a sensor detection area associated with at least one vehicle sensing device, and to compare a reputation score received from a Security Credential Management System (SCMS) and associated with a vehicle identifier related to the V2V message with a reputation score threshold, so as to identify whether the V2V message is a legitimate message or a malicious message based on the determination result.

[0011] In one embodiment, the abnormal behavior reporting module is configured to report the vehicle identifier associated with the V2V message to the SCMS when it is determined that the V2V message is malicious.

[0012] In one embodiment, a computer-readable medium includes instructions stored thereon for detecting anomalous behavior at an automated driving system (ADS), the instructions, when executed by a processor, causing the processor to receive a vehicle-to-vehicle (V2V) message including message-based vehicle data; receive sensor data from at least one vehicle sensing device; determine, at least in part, whether the V2V message is a legitimate or malicious message based on a comparison between the message-based vehicle data and sensor-based vehicle data generated from the sensor data; and manage the performance of the automated driving vehicle based on the message-based vehicle data based on the determination result.

[0013] In one embodiment, the computer-readable medium further includes instructions for causing a processor to determine, at least in part, whether a V2V message is a legitimate message or a malicious message based on a comparison of message-based vehicle data and sensor-based vehicle data generated from sensor data, the message-based vehicle data including the vehicle location of the source vehicle of the V2V message, and the sensor-based vehicle data including the sensor-based vehicle location of the source vehicle based on the sensor data.

[0014] In one embodiment, the computer-readable medium further includes instructions for causing a processor to determine whether a V2V message is a legitimate or malicious message based at least in part on performing a trustworthiness check on message-based vehicle data.

[0015] In one embodiment, the computer-readable medium further includes instructions for causing a processor to determine whether the vehicle location of a source vehicle is within a sensor detection area associated with at least one vehicle sensing device (the vehicle location of the source vehicle in the message-based vehicle data includes V2V messages) and to perform a sensor operation check of the at least one vehicle sensing device based on the determination result.

[0016] In one embodiment, the computer-readable medium further includes instructions for causing the processor to determine whether the vehicle location of the source vehicle is within a sensor detection area associated with at least one vehicle sensing device (the vehicle data based on the message includes the vehicle location of the source vehicle in the V2V message) and to compare the vehicle location of the source vehicle received in the V2V message with historical source vehicle location data to identify whether the V2V message is a legitimate message or a malicious message based on the determination result.

[0017] In one embodiment, the computer-readable medium further includes instructions for causing the processor to determine whether the vehicle location of the source vehicle is within a sensor detection area associated with at least one vehicle sensing device (the vehicle location of the source vehicle in the V2V message is included in the message-based vehicle data) and to compare a reputation score associated with a vehicle identifier received from a Security Credential Management System (SCMS) and related to the V2V message with a reputation score threshold to identify whether the V2V message is a legitimate or malicious message based on the determination result.

[0018] In one embodiment, the computer-readable medium further includes instructions for causing the processor to report the vehicle identifier associated with the V2V message to the SCMS when it determines that the V2V message is malicious.

[0019] In one embodiment, a method for detecting anomalous behavior at an automated driving system (ADS) includes: receiving a vehicle-to-vehicle (V2V) message including message-based vehicle data at a communication module; receiving sensor data received from at least one vehicle sensing device at a perception module; determining, at least in part, whether the V2V message is a legitimate message or a malicious message based on a comparison between the message-based vehicle data and sensor-based vehicle data generated from the sensor data at an anomalous behavior detection module; and managing the performance of the automated driving vehicle based on the message-based vehicle data based on the determination result.

[0020] In one embodiment, the method further includes: determining whether a V2V message is a legitimate message or a malicious message based at least in part on a comparison between message-based vehicle data and sensor-based vehicle data generated from sensor data, wherein the message-based vehicle data includes the vehicle location of the source vehicle of the V2V message, and the sensor-based vehicle data includes the sensor-based vehicle location of the source vehicle based on the sensor data.

[0021] In one embodiment, the method further includes: determining whether a V2V message is a legitimate message or a malicious message based at least in part on performing a trustworthiness check on message-based vehicle data.

[0022] In one embodiment, the method further includes: determining whether the vehicle location of the source vehicle is within a sensor detection area associated with at least one vehicle sensing device (the vehicle location of the source vehicle in the message-based vehicle data includes V2V messages); and performing a sensor operation check on the at least one vehicle sensing device based on the determination result.

[0023] In one embodiment, the method further includes: determining whether the vehicle location of the source vehicle is within a sensor detection area associated with at least one vehicle sensing device (the vehicle data based on the message includes the vehicle location of the source vehicle in the V2V message); and comparing the vehicle location of the source vehicle received in the V2V message with historical source vehicle location data to identify whether the V2V message is a legitimate message or a malicious message based on the determination result.

[0024] In one embodiment, the method further includes: determining whether the vehicle location of the source vehicle is within a sensor detection area associated with at least one vehicle sensing device (the vehicle data based on the message includes the vehicle location of the source vehicle of the V2V message); and comparing a reputation score received from a Security Credential Management System (SCMS) and associated with a vehicle identifier related to the V2V message with a reputation score threshold to identify whether the V2V message is a legitimate message or a malicious message based on the determination result. Attached Figure Description

[0025] Exemplary embodiments will be described below with reference to the accompanying drawings, in which the same reference numerals denote the same elements.

[0026] Figure 1 This is a functional block diagram of an autonomous vehicle including an abnormal behavior detection system, as one embodiment.

[0027] Figure 2 This is a functional block diagram of a controller, including one embodiment of an abnormal behavior detection system;

[0028] Figure 3 This is a flowchart of an embodiment of a method for detecting abnormal behavior at the Autopilot System (ADS) of an autonomous vehicle; and

[0029] Figure 4 This is a flowchart of an embodiment of a method for detecting abnormal behavior at the ADS of an autonomous vehicle. Detailed Implementation

[0030] The following detailed description is exemplary in nature and is not intended to limit the scope of this application and its uses. Furthermore, it is not intended to be limited by any express or implied theory set forth in the foregoing technical field, the summary of the invention, or the following detailed description. As used herein, the term "module" refers to one or any combination of any hardware, software, firmware, electronic control components, processing logic, and / or processor device, including but not limited to: application-specific integrated circuits (ASICs), electronic circuits, processors (shared processors, dedicated processors, or processor groups) and memories executing one or more software or firmware programs, combinational logic circuits, and / or other suitable components providing the said functionality.

[0031] This document describes embodiments of the present disclosure based on functional and / or logical block components and various processing steps. It should be understood that these block components can be implemented by any number of hardware, software, and / or firmware components configured to perform specified functions. For example, embodiments of the present disclosure may employ various integrated circuit components (e.g., memory elements, digital signal processing elements, logic elements, or lookup tables, etc.) that can perform various functions under the control of one or more microprocessors or other control devices. Furthermore, those skilled in the art will understand that embodiments of the present disclosure can be practiced in conjunction with any number of systems, and the systems described herein are merely exemplary embodiments of the present disclosure.

[0032] For the sake of brevity, conventional techniques relating to signal processing, data transmission, signaling, control, and other functional aspects of the system (and its various operating components) are not described in detail herein. Furthermore, the connections shown in the various figures included herein are intended to illustrate exemplary functional relationships and / or physical couplings between various elements. It should be noted that many alternative or additional functional relationships or physical connections may exist in one embodiment of this disclosure.

[0033] See Figure 1 The diagram illustrates a functional block diagram of an autonomous vehicle 100 including an abnormal behavior detection system 110, one embodiment of which is shown. The abnormal behavior detection system 110 is configured to detect abnormal behavior in a vehicle-to-vehicle (V2V) messaging scenario. The abnormal behavior detection system 110 is configured to compare vehicle data received in a V2V message with vehicle data generated based on sensor data received from a vehicle sensor system to determine whether the received V2V message is a legitimate V2V message or a malicious V2V message. In one embodiment, the vehicle data is the vehicle location of the source vehicle sending the V2V message. If the abnormal behavior detection system 110 identifies a discrepancy between the vehicle location in the V2V message and the vehicle location based on the sensor data, the abnormal behavior detection system 110 determines that the received V2V message is malicious.

[0034] An autonomous vehicle 100 typically includes a chassis 112, a body 114, front wheels 116, and rear wheels 118. The body 114 is mounted on the chassis 112 and substantially encloses the components of the autonomous vehicle 100. The body 114 and the chassis 112 may together form a frame. The front wheels 116 and the rear wheels 118 are each rotatably connected to the chassis 112 near a corresponding corner of the body 114.

[0035] The autonomous vehicle 100 is, for example, a vehicle that is automatically controlled to transport passengers from one location to another. Although the autonomous vehicle 100 is depicted as a passenger car in the illustrated embodiment, other examples of autonomous vehicles include, but are not limited to, motorcycles, trucks, sport utility vehicles (SUVs), recreational vehicles (RVs), ships, and aircraft. In one embodiment, the autonomous vehicle 100 is a so-called Level 4 or Level 5 automation system. A Level 4 system means “high automation,” referring to the driving mode-specific performance of the Automated Driving System (ADS) for all aspects of a dynamic driving task, even when a human driver does not respond appropriately to an intervention request. A Level 5 system means “full automation,” referring to the all-time performance of the ADS for all aspects of a dynamic driving task under all road and environmental conditions that a human driver can handle.

[0036] As shown in the figure, an autonomous vehicle 100 typically includes a propulsion system 120, a transmission system 122, a steering system 124, a braking system 126, a vehicle sensor system 128, an actuator system 130, at least one data storage device 132, at least one controller 134, and a vehicle communication system 136. In various embodiments, the propulsion system 120 may include an internal combustion engine, an electric motor (such as a traction motor), and / or a fuel cell propulsion system. The transmission system 122 is configured to transmit power from the propulsion system 120 to the front wheels 116 and the rear wheels 118 according to a selectable speed ratio. According to various embodiments, the transmission system 122 may include a stepped automatic transmission, a continuously variable transmission (CVT), or other suitable transmission. The braking system 126 is configured to provide braking torque to the front wheels 116 and the rear wheels 118. In various embodiments, the braking system 126 may include friction brakes, brake-by-wire brakes, regenerative braking systems such as those powered by an electric motor, and / or other suitable braking systems. The steering system 124 influences the position of the front wheels 116 and the rear wheels 118. Although the steering system 124 is depicted as including a steering wheel for illustrative purposes, in some embodiments contemplated within the scope of this disclosure, the steering system 124 may not include a steering wheel.

[0037] The vehicle sensor system 128 includes one or more vehicle sensing devices 140a-140n that sense observable conditions of the external and / or internal environments of the autonomous vehicle 100. Examples of vehicle sensing devices 140a-140n include, but are not limited to, radar, lidar, GPS, optical cameras, thermal imaging cameras, ultrasonic sensors, and / or other sensors. The actuator system 130 includes one or more actuator devices 142a-142n that control one or more vehicle features, such as, but not limited to, propulsion system 120, transmission system 122, steering system 124, and braking system 126. In various embodiments, vehicle features may also include internal and / or external vehicle features, such as, but not limited to, doors, trunk, and cabin features (such as, for example, air, music, and lighting).

[0038] Vehicle communication system 136 is configured to wirelessly transmit information (“vehicle-to-everything (V2X) communication”) with other entities 148, such as, but not limited to, other vehicles (“V2V” communication), infrastructure (“V2I” communication), remote systems, and / or personal devices. In one embodiment, vehicle communication system 136 is a wireless communication system configured to communicate via a wireless local area network (WLAN) employing the IEEE 802.11 standard or via cellular data communication. However, additional or alternative communication methods (such as Dedicated Short Range Communication (DSRC) channels) are also considered within the scope of this disclosure. DSRC channels refer to one-way or two-way short-to-medium range wireless communication channels designed for automobiles, and a corresponding set of protocols and standards.

[0039] Data storage device 132 stores data used for automatically controlling the autonomous vehicle 100. Data storage device 132 may be part of but separate from controller 134, or it may be part of controller 134 and part of an independent system.

[0040] The controller 134 includes at least one processor 144 and a computer-readable storage device 146. The computer-readable storage device 146 may also refer to a computer-readable medium 146. In one embodiment, the computer-readable storage device 146 includes an embodiment of an abnormal behavior detection system 110. The processor 144 can be any custom or commercially available processor, central processing unit (CPU), graphics processing unit (GPU), auxiliary processor among several processors associated with the controller 134, semiconductor-based microprocessor (in the form of a microchip or chipset), macroprocessor, any combination thereof, or any device generally used for executing instructions. For example, the computer-readable storage device 146 may include volatile and non-volatile storage in read-only memory (ROM), random access memory (RAM), and persistent powered-on memory (KAM). KAM is persistent or non-volatile memory that can be used to store various operational variables when the processor 144 is powered off. The computer-readable storage device 146 may be implemented using any of a variety of known storage devices, such as PROM (programmable read-only memory), EPROM (electrically programmable read-only memory), EEPROM (electrically erasable programmable read-only memory), flash memory, or any other electrical, magnetic, optical, or combined storage device capable of storing data (some of which represent executable instructions used by the controller 134 in controlling the autonomous vehicle 100).

[0041] The instructions may include one or more separate programs, each comprising a sequence of executable instructions for implementing logical functions. When executed by processor 144, the instructions receive and process signals from vehicle sensor system 128, perform logic, calculations, methods, and / or algorithms to automatically control components of autonomous vehicle 100, and generate control signals to actuator system 130 to automatically control one or more components of autonomous vehicle 100 based on logic, calculations, methods, and / or algorithms. Although in Figure 1 Only one controller 134 is shown, but alternative embodiments of the autonomous vehicle 100 may include any number of controllers 134 that communicate via any suitable communication medium or combination of communication media and cooperate in processing sensor signals, executing logic, calculations, methods and / or algorithms, and generating control signals to automatically control the features of the autonomous vehicle 100.

[0042] In various embodiments, one or more instructions of controller 134 are implemented to provide the ADS functionality as described with reference to one or more embodiments herein. Controller 134 or one of its functional modules is configured to implement the functionality described in one or more embodiments of the reference anomalous behavior detection system 110.

[0043] See Figure 2 The diagram shows a functional block diagram of a controller 134, including one embodiment of an abnormal behavior detection system 110. The controller 134 is configured to be communicatively coupled to a vehicle sensor system 128 and a vehicle communication system 136. In one embodiment, the controller 134 is configured to be communicatively coupled to a Security Credential Management System (SCMS) 212. In one embodiment, the SCMS 212 is located in a back-end office. In another embodiment, the SCMS 212 is located in an edge computing cluster. The SCMS 212 includes a Certificate Authority (CA) 214 and an abnormal behavior management authority 216.

[0044] The vehicle sensor system 128 includes one or more vehicle sensing devices 140a-140n, which are configured to generate sensor data based on the external and / or internal environment of the autonomous vehicle 100. Examples of vehicle sensing devices 140a-140n include, but are not limited to, radar, lidar, global positioning system, optical camera, thermal imaging camera, ultrasonic sensor and / or other sensors.

[0045] Vehicle communication system 136 is configured to wirelessly transmit information to each other with other entities 148. An example of entity 148 is another autonomous vehicle. An example of wireless communication with another vehicle is V2V communication with other vehicles. An example of V2V communication is a V2V message. In one embodiment, communication system 136 is a wireless communication system configured to communicate via a wireless local area network (WLAN) employing the IEEE 802.11 standard or via cellular data communication. However, additional or alternative communication methods (such as Dedicated Short Range Communication (DSRC) channels) are also considered within the scope of this disclosure. A DSRC channel refers to a one-way or two-way short-to-medium range wireless communication channel specifically designed for automobiles, along with a corresponding set of protocols and standards. Vehicle communication system 136 is configured to receive V2V messages from other autonomous vehicles. The autonomous vehicle sending the V2V message to autonomous vehicle 100 may be referred to as the source vehicle. In one embodiment, the V2V message is a Basic Safety Message (BSM).

[0046] In one embodiment, controller 134 implements the ADS within the autonomous vehicle 100. That is, suitable software and / or hardware components of controller 134 (e.g., processor 144 and computer-readable storage device 146) are used to provide the ADS for use in conjunction with other components of the autonomous vehicle 100. In one embodiment, the instructions of the ADS are organized by function or system. In one embodiment, the anomalous behavior detection system 110 described herein and its functions are part of the ADS and implement at least a portion of the functions of the ADS. The ADS includes additional components (not shown) that facilitate the operation of the autonomous vehicle 100. Controller 134 is configured to communicatively couple to other components (not shown) of the autonomous vehicle 100 to facilitate the operation of the ADS.

[0047] Controller 134 includes at least one processor 144 and memory 146. Memory 146 is also referred to as a computer-readable storage device, computer-readable medium, or computer-readable medium. In one embodiment, memory 146 includes an embodiment of an abnormal behavior detection system 110, a sensing module 200, and a communication module 202. In one embodiment, memory 146 includes an embodiment of an abnormal behavior detection system 110, a sensing module 200, a communication module 206, and a historical data module 206. In one embodiment, historical data module 206 is a component of controller 134. In one embodiment, historical data module 206 is a component of data storage device 132.

[0048] Sensing module 200 is configured to receive sensor data from one or more vehicle sensing devices 140a-140n of vehicle sensor system 128. In one embodiment, sensing module 200 is configured to generate sensor-based vehicle data based on the sensor data. An example of sensor-based vehicle data is the sensor-based vehicle position of different vehicles within the sensor detection area of ​​vehicle sensor system 128. Historical data module 206 is configured to store historical sensor-based vehicle data generated by vehicle sensor system 128. An example of historical sensor-based vehicle data is historical source vehicle position data.

[0049] Vehicle communication system 136 is configured to receive V2X messages. An example of V2X communication is a V2V message. Communication module 202 is configured to process V2V messages received from the source vehicle. Communication module 202 is configured to process the received V2V communication according to the physical layer (PHY), media access control (MAC), and short message protocol (WSMP) associated with the received V2V communication.

[0050] In one embodiment, communication module 202 includes a security service layer. In another embodiment, communication module 202 includes an IEEE 1609.2 security service layer. The security service layer is configured to determine whether the certificate associated with a received V2X message is an authorized certificate or a legitimate certificate.

[0051] Communication module 202 includes a V2X application. In one embodiment, the V2X application is configured to generate message-based vehicle data based on V2V messages received at communication module 202 via vehicle communication system 136. The message-based vehicle data includes vehicle attributes of the source vehicle. Examples of vehicle attributes include, but are not limited to, the source vehicle's speed, vehicle location or position, acceleration, and heading. The V2V message includes a timestamp and vehicle identifier associated with the source vehicle.

[0052] In one embodiment, the V2X application is configured to analyze message-based vehicle data to determine whether the autonomous vehicle 100 poses a potential risk. The ADS uses the potential risks identified by the V2X application to implement one or more risk avoidance actions. For example, message-based vehicle data associated with a source vehicle may indicate that the source vehicle is located at an intersection. The V2X application may determine that the source vehicle poses a potential collision risk to the autonomous vehicle 100. By issuing a command to the braking system 126, the ADS may implement one or more actions to slow down or stop the autonomous vehicle 100 to avoid a potential collision with the source vehicle.

[0053] In one embodiment, the abnormal behavior detection system 110 includes an abnormal behavior detection module 208. In another embodiment, the abnormal behavior detection system 110 includes the abnormal behavior detection module 208 and an abnormal behavior reporting module 210. The abnormal behavior detection module 208 is configured to compare message-based vehicle data generated by the communication module 202 with sensor-based vehicle data generated by the perception module 200 to determine whether the V2V message is a legitimate message or a malicious message.

[0054] When message-based vehicle data (based on V2V messages) and sensor-based vehicle data (based on sensor data) match, the abnormal behavior detection module 208 determines that the received V2V message is a legitimate message. In one embodiment, the message-based vehicle data is the message-based vehicle location of the source vehicle identified in the V2V message, and the sensor-based vehicle data is the sensor-based vehicle location of the source vehicle. When the sensor-based vehicle location confirms that the actual vehicle exists at the message-based vehicle location, the abnormal behavior detection module 208 determines that the received V2V message is a legitimate message.

[0055] When message-based vehicle data based on V2V messages does not match sensor-based vehicle data based on sensor data, the abnormal behavior detection module 208 determines that the received V2V message is malicious. In one embodiment, message-based vehicle data is the message-based vehicle location of the source vehicle identified in the V2V message, and sensor-based vehicle data is the sensor-based vehicle location of the source vehicle. When the sensor-based vehicle location cannot confirm the existence of the actual vehicle at the message-based vehicle location, the abnormal behavior detection module 208 determines that the received V2V message is malicious. A malicious V2V message may appear to be generated by an actual vehicle but is actually generated by a malicious entity. The malicious entity may be attempting a Sybil attack, where the malicious V2V message is generated by a ghost vehicle or a non-existent vehicle. The abnormal behavior detection module 208 is configured to notify the V2X application that the V2V message it receives is a malicious message and to ignore the vehicle data associated with the malicious message, thereby ensuring that the ADS does not perform navigation and / or guidance actions based on the vehicle data based on the malicious message.

[0056] V2V messages include a vehicle identifier that identifies the source vehicle associated with the V2V message. When the abnormal behavior detection module 208 determines that a received V2V message is a malicious V2V message, the abnormal behavior detection module 208 classifies the vehicle identifier associated with the malicious V2V message as a malicious vehicle identifier. In one embodiment, the abnormal behavior detection module 208 is configured to notify the communication module 202 that the vehicle identifier associated with the received V2V message is a malicious vehicle identifier, causing the communication module 202 to identify any future V2V messages containing the malicious vehicle identifier as malicious V2V messages and ignore message-based vehicle data associated with these malicious V2V messages.

[0057] In one embodiment, the abnormal behavior detection module 208 is configured to notify the abnormal behavior reporting module 210 that the vehicle identifier associated with the received malicious V2V message is a malicious vehicle identifier. The abnormal behavior reporting module 210 sends a classification report including the malicious vehicle identifier to the SCMS 212.

[0058] In one embodiment, when the abnormal behavior detection module 208 classifies the vehicle identifier of a vehicle as a malicious vehicle identifier, the abnormal behavior detection module 208 generates a classification report including a unique identifier based on the vehicle's license plate, vehicle characteristics, and the vehicle's V2V message or BSM identifier, and maps the unique identifier to vehicles classified as legitimate or malicious vehicles. The abnormal behavior reporting module 210 sends the classification report to the SCMS 212.

[0059] In one embodiment, the abnormal behavior management unit 216 at SCMS 212 receives a classification report including a malicious vehicle identifier and broadcasts the malicious vehicle identifier to other autonomous vehicles near the autonomous vehicle 100 that identified the malicious vehicle identifier, causing these other autonomous vehicles to identify received V2V messages associated with the malicious vehicle identifier as malicious V2V messages and ignore message-based vehicle data associated with these malicious V2V messages.

[0060] In one embodiment, SCMS 212 maintains a record of the number of classification reports received from the autonomous vehicle indicating that the vehicle identifier is a malicious vehicle identifier. SCMS 212 calculates a reputation score associated with the vehicle identifier. The reputation score reflects the probability that the vehicle identifier is a malicious vehicle identifier. The higher the reputation score, the higher the probability that the vehicle identifier is a malicious vehicle identifier.

[0061] although Figure 2 The diagram shows several different components of the autonomous vehicle 100 and controller 134, but the autonomous vehicle 100 and / or controller 134 may include additional components that facilitate the operation of the autonomous vehicle.

[0062] See Figure 3 The diagram shows a flowchart of one embodiment of a method 300 for detecting anomalous behavior at the Adaptive Controller System (ADS) of an autonomous vehicle 100. Method 300 is performed by a controller 134, including an anomalous behavior detection system 110, in one embodiment. Method 300 can be performed by the controller 134 in conjunction with other components of the autonomous vehicle 100. Method 300 can be performed by hardware circuitry, firmware, software, and / or a combination thereof. The method references... Figure 2 Describe it.

[0063] In step 302, a V2V message is received via a wireless communication channel at the vehicle communication system 136. In one embodiment, the V2V message is received at the controller 134 via the vehicle communication system 136. In another embodiment, the V2V message is received at the communication module 202 via the vehicle communication system 136. The V2V message includes a vehicle identifier associated with the source vehicle, a timestamp, and message-based vehicle data. The message-based vehicle data includes vehicle attributes of the source vehicle. Examples of vehicle attributes include, but are not limited to, the source vehicle's speed, vehicle location or position, acceleration, and heading. The V2V message includes a timestamp and a vehicle identifier associated with the source vehicle. The abnormal behavior detection module 208 receives the message-based vehicle data from the communication module 202. In one embodiment, the V2V message is a BSM message.

[0064] In step 304, almost simultaneously with receiving V2V messages at the autonomous vehicle 100, sensor data is received from the vehicle sensor system 128 at the perception module 200. In one embodiment, sensor data is received at the perception module 200 from one or more vehicle sensing devices 140a-140n of the vehicle sensor system 128. Examples of vehicle sensing devices 140a-140n include, but are not limited to, radar, lidar, GPS, optical cameras, thermal imaging cameras, ultrasonic sensors, and / or other sensors. In one embodiment, the perception module 200 is configured to generate sensor-based vehicle data based on the sensor data. An abnormal behavior detection module 208 is configured to receive sensor-based vehicle data from the perception module 200. In one embodiment, the abnormal behavior detection module 208 is configured to receive sensor data from the perception module 200 and generate sensor-based vehicle data based on that sensor data. The sensor-based vehicle data includes one or more sensor-based vehicle attributes associated with the source vehicle.

[0065] In step 306, the abnormal behavior detection module 208 is configured to identify the sensor detection area associated with the vehicle sensor system 128 almost simultaneously with receiving the V2V message at the autonomous vehicle 100. The message-based vehicle data received in the V2V message includes the message-based vehicle location or position of the source vehicle. In step 308, the abnormal behavior detection module 208 determines whether the message-based vehicle location of the source vehicle in the V2V message is within the sensor detection area.

[0066] If the abnormal behavior detection module 208 determines in step 308 that the message-based vehicle location of the source vehicle is within the sensor detection area, then the abnormal behavior detection module 208 is configured to determine whether the received V2V message is a legitimate message based on the comparison between the message-based vehicle data and the sensor-based vehicle data in step 310.

[0067] If the abnormal behavior detection module 208 determines in step 310 that the message-based vehicle data does not match the sensor-based vehicle data, then in step 312, the abnormal behavior detection module 208 identifies the V2V message as a malicious message and identifies the vehicle identifier in the V2V message as a malicious vehicle identifier. The abnormal behavior detection module 208 is configured to notify the V2X application that the received V2V message is a malicious message and ignore the message-based vehicle data associated with the malicious message, thereby ensuring that the ADS will not perform navigation and / or guidance actions based on the vehicle data based on the malicious message.

[0068] In one embodiment, the abnormal behavior reporting module 210 is configured to generate a classification report including a malicious vehicle identifier and send the classification report including the malicious vehicle identifier to SCMS 212. The abnormal behavior management agency 216 at SCMS 212 stores the malicious vehicle identifier at the SCMS. The abnormal behavior management agency broadcasts the malicious vehicle identifier to autonomous vehicles located near the autonomous vehicle 100.

[0069] In one embodiment, message-based vehicle data is the message-based vehicle location of the source vehicle identified in the V2V message, and sensor-based vehicle data is the sensor-based vehicle location of the source vehicle. When the sensor-based vehicle location cannot confirm the actual vehicle's presence at the message-based vehicle location, the abnormal behavior detection module 208 determines that the received V2V message is malicious. A malicious V2V message may appear to be generated by an actual vehicle but is actually generated by a malicious entity. The malicious entity may be attempting a Sybil attack, where the malicious V2V message is generated by a ghost vehicle or a non-existent vehicle.

[0070] If the abnormal behavior detection module 208 determines in step 310 that the message-based vehicle data matches the sensor-based vehicle data, then in step 314, the abnormal behavior detection module 208 is configured to determine whether the received V2V message is a legitimate message based on performing a vehicle credibility check on the message-based vehicle data. The vehicle credibility check is used to determine whether the message-based vehicle data is credible. In one embodiment, the vehicle credibility check includes one or more of the following: source vehicle speed credibility check, source vehicle position credibility check, vehicle acceleration credibility check, vehicle sudden appearance credibility check, vehicle message frequency credibility check, vehicle heading credibility check, and vehicle continuous message consistency credibility check.

[0071] If the abnormal behavior detection module 208 determines in step 314 that the message-based vehicle data has failed the vehicle trustworthiness check, then method 300 proceeds to step 312, where the abnormal behavior detection module 208 performs the process associated with identifying the V2V message as a malicious message as described above.

[0072] If the abnormal behavior detection module 208 determines in step 314 that the message-based vehicle data has passed the vehicle credibility check, then in step 316, the abnormal behavior detection module 208 identifies the V2V message as a legitimate message. When the V2V message is identified as a legitimate message, the controller 134 is configured to implement ADS in the autonomous vehicle 100 based on the message-based vehicle data.

[0073] If the abnormal behavior detection module 208 determines in step 308 that the message-based vehicle location of the source vehicle in the V2V message is not within the sensor detection area, then the abnormal behavior detection module 208 is configured to determine in step 318 whether the vehicle sensing devices 140a-140n used to determine the sensor detection area are operable. In one embodiment, the abnormal behavior detection module 208 is configured to issue a command to the vehicle sensor system 128 to perform a sensor operation check on the vehicle sensing devices 140a-140n used to determine the sensor detection area. If the vehicle sensing devices 140a-140n used to determine the sensor detection area fail the sensor operation check in step 318, a sensor repair instruction is generated in step 320, and method 300 proceeds to step 314.

[0074] If the vehicle sensing devices 140a-140n used to determine the sensor detection area in step 318 pass the sensor operation check, then in step 322, the abnormal behavior detection module 208 is configured to determine whether the received V2V message has passed the vehicle trustworthiness check based on message-based vehicle data.

[0075] If the abnormal behavior detection module 208 determines in step 322 that the message-based vehicle data has failed the vehicle trustworthiness check, the method proceeds to step 312, where the abnormal behavior detection module 208 performs the process associated with identifying the V2V message as a malicious message as described above.

[0076] If the abnormal behavior detection module 208 determines in step 322 that the message-based vehicle data has passed the vehicle credibility check, then in step 324, the abnormal behavior detection module 208 is configured to determine whether the reputation score associated with the vehicle identifier of the source vehicle is greater than the reputation score threshold.

[0077] The abnormal behavior detection module 208 requests a reputation score associated with the vehicle identifier in the V2V message from SCMS 212 and identifies the V2V message as either a legitimate or malicious message based on the received reputation score. The reputation score associated with the vehicle identifier represents historical behavior associated with that vehicle identifier. In one embodiment, the higher the number of malicious reports associated with the vehicle identifier, the lower the reputation score associated with that vehicle identifier. The abnormal behavior detection module 208 compares the received reputation score with a reputation score threshold. If the reputation score is higher than the reputation score threshold, the V2V message is identified as a legitimate message, and method 300 proceeds to step 316. If the reputation score is lower than the reputation score threshold, the V2V message is identified as a malicious message, and the method proceeds to step 312.

[0078] In one embodiment, the anomaly detection module 208 is configured to generate a reputation score based on an evaluation of a reputation score associated with a vehicle identifier received from SCMS 212 and historical source vehicle location data retrieved from historical data module 206. Historical data module 206 stores historical vehicle location data associated with vehicles previously detected by vehicle sensor system 128. The anomaly detection module 208 uses the historical vehicle location data to determine whether vehicle sensor system 128 previously detected a source vehicle associated with a vehicle identifier in a V2V message. If the anomaly detection module 208 determines that vehicle sensor system 128 previously detected a source vehicle within the vehicle sensor detection area, then in step 324, the anomaly detection module 208 generates a new, higher reputation score for comparison with a reputation score threshold.

[0079] See Figure 4 This illustrates a flowchart of one embodiment of a method for detecting anomalous behavior at the Adaptive Controller System (ADS) of an autonomous vehicle. Method 400 is performed by a controller 134, including an anomalous behavior detection system 110, as described in one embodiment. Method 400 can be performed by the controller 134 in conjunction with other components of the autonomous vehicle 100. Method 400 can be performed by hardware circuitry, firmware, software, and / or combinations thereof. The method references… Figure 2 Describe it.

[0080] In step 402, a V2V message including message-based vehicle data is received at communication module 202. In step 404, sensor data is received from at least one vehicle sensing device at perception module 200. In step 406, abnormal behavior detection module 208 determines, at least in part, whether the V2V message is legitimate or malicious based on a comparison between the message-based vehicle data and sensor-based vehicle data generated from the sensor data. Processor 134 manages the performance of the autonomous vehicle 100 based on the determination result and the message-based vehicle data.

[0081] Employing an anomaly detection system 110 at the autonomous vehicle 100 can help identify Sybil attacks on malicious or phantom vehicles by comparing message-based vehicle data contained in received V2V messages with sensor-based vehicle data generated by the vehicle sensor system 128. Identifying Sybil attacks by malicious entities can reduce the infiltration of malicious message-based vehicle data received via malicious V2V messages into the intelligent transportation system (ITS) of the autonomous vehicle 100. Employing anomaly detection system 110 at the autonomous vehicle 100 can help remove anomalous or malicious entities from the V2X ecosystem, thereby protecting the autonomous vehicle 100 and the entire autonomous vehicle system.

[0082] While at least one exemplary embodiment has been presented in the foregoing detailed description, it should be understood that numerous variations exist. It should also be understood that one or more exemplary embodiments are merely examples and are not intended to limit the scope, applicability, or configuration of this disclosure in any way. Rather, the foregoing detailed description will provide those skilled in the art with a convenient roadmap for implementing one or more exemplary embodiments. It should be understood that various changes can be made to the function and arrangement of the elements without departing from the scope of this disclosure as set forth in the appended claims and their legal equivalents.

Claims

1. An autonomous driving system (ADS) for an autonomous vehicle, comprising an abnormal behavior detection system, wherein the ADS includes: The communication module is configured to receive vehicle-to-vehicle V2V messages, including message-based vehicle data. A sensing module configured to receive sensor data from at least one vehicle sensing device; An abnormal behavior detection module is configured to determine whether a V2V message is a legitimate message or a malicious message based at least in part on a comparison between the message-based vehicle data and sensor-based vehicle data generated based on the sensor data. The historical data module is configured to store historical source vehicle location data associated with previously detected vehicles; as well as The processor is configured to manage the performance of the autonomous vehicle based on the message-based vehicle data, according to a determined result. The message-based vehicle data includes the vehicle location of the source vehicle in the V2V message, and the abnormal behavior detection module is configured as follows: Determine whether the vehicle position of the source vehicle is within the sensor detection area associated with the at least one vehicle sensing device; and A reputation score is generated based on an evaluation of a reputation score associated with a vehicle identifier related to the V2V message received from the Security Credential Management System (SCMS) and historical source vehicle location data retrieved from the historical data module. This reputation score is then compared with a reputation score threshold to identify whether the V2V message is legitimate or malicious based on the determination result.

2. The autonomous driving system ADS according to claim 1, wherein the sensor-based vehicle data includes the sensor-based vehicle position of the source vehicle based on the sensor data.

3. The autonomous driving system ADS of claim 1, wherein the abnormal behavior detection module is configured to determine whether the V2V message is a legitimate message or a malicious message based at least in part on performing a credibility check of the message-based vehicle data.

4. The autonomous driving system ADS according to claim 1, wherein the abnormal behavior detection module is configured as follows: Determine whether the vehicle position of the source vehicle is within the sensor detection area associated with the at least one vehicle sensing device; and Based on the determination result, perform a sensor operation check on the at least one vehicle sensing device.

5. The autonomous driving system ADS according to claim 1, wherein the abnormal behavior reporting module is configured to report the vehicle identifier associated with the V2V message to the SCMS when it is determined that the V2V message is a malicious message.

6. A computer-readable medium comprising instructions stored thereon for detecting anomalous behavior at an automated driving system (ADS), the instructions, when executed by a processor, causing the processor to perform the following operations: Receive vehicle-to-vehicle (V2V) messages that include message-based vehicle data; Receive sensor data from at least one vehicle sensing device; The determination of whether a V2V message is legitimate or malicious is based at least in part on a comparison between the message-based vehicle data and sensor-based vehicle data generated from sensor data. as well as Based on the determined results, the performance of the autonomous vehicle is managed according to the message-based vehicle data; The message-based vehicle data includes the vehicle location of the source vehicle for the V2V message, and the instructions, when executed by the processor, also cause the processor to perform the following operations: Determine whether the vehicle position of the source vehicle is within the sensor detection area associated with the at least one vehicle sensing device; and A reputation score is generated based on an evaluation of a reputation score associated with a vehicle identifier related to the V2V message received from the Security Credential Management System (SCMS) and historical source vehicle location data retrieved from the historical data module. This reputation score is then compared with a reputation score threshold to identify whether the V2V message is legitimate or malicious based on the determination result.

7. The computer-readable medium of claim 6, further comprising instructions for causing the processor to determine, at least in part, whether the V2V message is a legitimate or malicious message based on a comparison of the message-based vehicle data with sensor-based vehicle data generated based on the sensor data, and the sensor-based vehicle data including a sensor-based vehicle location of the source vehicle based on the sensor data.

8. The computer-readable medium of claim 6, further comprising instructions for causing the processor to determine whether the V2V message is a legitimate message or a malicious message based at least in part on performing a trustworthiness check on the message-based vehicle data.

Images