Method for monitoring data communication of motor vehicle and motor vehicle having attack detection system

Abstract

The invention relates to a method for monitoring a data communication of a motor vehicle (10) by means of an attack detection system (12), in which the attack detection system (12) analyses at least a first part (D1) of the data of the data communication in order to monitor the data communication. In this case, in a first operating state (B1) of the motor vehicle (10), a first portion (D1) of the data is stored, and in a second operating state (B2) of the motor vehicle (10), which differs from the first operating state, in which the motor vehicle (10) is in a stationary state and not in a driving mode, in which the stored first portion (D1) of the data is evaluated by an attack detection system (12).

Description

Technical Field

[0001] The invention relates to a method for monitoring data communications of a motor vehicle by means of an attack recognition system, wherein the attack recognition system for monitoring the data communications evaluates at least a portion of the data of the data communications. The invention also relates to a motor vehicle having an attack recognition system. Background Art

[0002] Such attack recognition systems are also referred to as intrusion detection systems (IDS for short). At this point, such attack recognition systems or anomaly recognition systems are increasingly being used in modern vehicles. These systems usually require very high computing power to analyze large data sets. Ideally, a complete IDS continuously analyzes the entire data communication / data transmission. This is not feasible in motor vehicles due to severe limitations in computing power. Therefore, only basic IDS (Basis-IDS) is usually used in motor vehicles. Typical IDS methods, especially basic IDS methods, are based on continuous evaluation of a portion of the network communication. Therefore, the analysis capabilities of such basic IDS are limited or minimized. Since the amount of data in such data communications is very large, mirroring the entire vehicle network communication from the vehicle to the back end cannot be meaningfully implemented either.

[0003] Therefore, efforts are made to improve the security of attack recognition systems in motor vehicles without providing more computing power in the motor vehicle. US2019 / 0308589 A1 describes an attack recognition method, according to which a processor of a motor vehicle predicts a motor vehicle state using a behavioral model, wherein the model is designed to predict the motor vehicle state based on one or more state variables provided by one or more subsystems of the motor vehicle. In addition, the processor calculates a difference between the predicted state and the measured state of the motor vehicle, and determines a malicious intrusion based on the calculated difference exceeding a predetermined threshold.

[0004] EP 3900974 A1 describes a charging device for an electrical device (e.g., an electric vehicle), the charging device having a charging interface, a configuration module, a detection module, a check module, and a permission module, the permission module being configured to control data communication between the charging device and the electrical device or control a charging process of the electrical device through control commands according to a check result provided by the check module and determined based on connection characteristics. Here, the check module may include a monitoring module, such as a network intrusion detection system.

[0005] DE 10 2017 214 071 A1 describes a method for charging an electric vehicle, wherein a computing center is connected to a charging station via a first data connection and to the electric vehicle via a second data connection, and the electric vehicle is charged by the charging station while the computing center controls the charging of the charging station and the electric vehicle. Anomalies in the communication network can be detected by an attack detection system. Maintenance or expansion of the control mechanism of the attack detection system can be realized in a cloud infrastructure provided by the computing center.

[0006] However, the problem stated at the beginning still exists. Summary of the invention

[0007] The object of the present invention is to provide a method and a motor vehicle which allow a design that is as simple and reliable as possible for an attack detection system for monitoring data traffic of a motor vehicle.

[0008] This object is achieved by a method and a motor vehicle having the features according to the respective independent claims. Advantageous embodiments of the invention are the subject matter of the dependent claims, the description and the drawings.

[0009] In the method for monitoring data communication of a motor vehicle by means of an attack recognition system according to the invention, the attack recognition system for monitoring data communication analyzes at least a first part of the data of the data communication. In this case, the first part of the data is stored in a first operating state of the motor vehicle, and the first part of the stored data is analyzed by the attack recognition system in a second operating state of the motor vehicle that is different from the first operating state, in which the motor vehicle is at a standstill and not in driving operation.

[0010] The invention makes use of the knowledge that, on the one hand, in normal driving situations, there is usually not enough computing power to implement a complete IDS, but there are other operating states of the motor vehicle, in particular in which the motor vehicle is not in driving operation, in which correspondingly more computing power can be used, because various systems (in particular driver assistance systems) and functions are not executed in this second operating state, and therefore additional computing power is available for monitoring data communication. Therefore, in the present case, a first part of the data is stored in a first operating state of the motor vehicle, for example during driving operation, and the stored data can then be advantageously analyzed by the attack recognition system in the second operating state, in which correspondingly more computing power is available. This allows a significantly more computationally intensive and more comprehensive analysis of the data. At the same time, it is no longer necessary to provide computing power in the motor vehicle for this purpose, because the computing power that is not used in the stationary state of the motor vehicle and is used by various motor vehicle systems to implement other functions in driving operation can now be used by the attack recognition system for data analysis. Although it may not be possible to analyze all data of the data communication due to the design of the memory for storing the first part of the data, such an analysis allows significantly more comprehensive monitoring than previous attack recognition systems. Therefore, the present invention can advantageously improve the reliability of the attack identification system in a simple manner.

[0011] Here, the attack identification system can be understood as the IDS (Intrusion Detection System) described at the beginning. Here, the attack identification system is designed to identify attacks or data tampering by unauthorized persons. In addition, within the scope of the present invention, the attack identification system or IDS can be understood as software or a program, or can also be understood as a physical device or a collaborative cluster of physical devices, for example, a controller or a computing unit that implements corresponding software for attack identification. The attack identification system can also be understood as a collection of hardware components and / or firmware components and / or software components for attack identification. The attack identification system can also be called an attack identification device. The attack identification system is also partially referred to as IDS in the following text.

[0012] Here, the data communication of the motor vehicle preferably refers to the network communication of the motor vehicle, in particular the network communication inside the motor vehicle and / or the network communication between the motor vehicle and network participants outside the motor vehicle. In other words, the data communication between the various components of the motor vehicle and the data communication between the motor vehicle and at least one component outside the motor vehicle can be monitored. Here, the data of the data communication is collected inside the vehicle, in particular, the data of the data communication is collected at a plurality of different detection points. Here, in order to monitor and detect anomalies or abnormalities, the IDS can use analysis methods known in the prior art to analyze the first part of the data, such as pattern recognition methods using filters and / or signatures. Therefore, the detailed analysis of the data will not be discussed below.

[0013] Thus, a first portion of the data is stored in a first operating state of the motor vehicle and analyzed in a second operating state entered later in time. Here, the analysis by the attack recognition system can be triggered as soon as the second operating state of the vehicle is detected. In particular, the analysis of the first portion of the data can be triggered as soon as the transition of the motor vehicle into the second operating state is detected. However, the data analysis can also be performed at any subsequent time when the vehicle is still in the second operating state. However, triggering the analysis of the first portion of the data immediately upon detection of the entry of the motor vehicle into the second operating state has the great advantage that in this case as much time as possible is available for the data analysis. Here, the duration of the analysis by the attack recognition system can be up to several minutes, or even an hour or more. If the analysis starts at the beginning of the second operating state, the parking time of the motor vehicle can be optimally utilized and it is likely that the analysis does not have to be interrupted, as is the case when resuming driving operation.

[0014] The first part of the data can in principle be any data subset of all the data of the data communication. However, it is preferably data of a temporally coherent or continuous data stream within a certain time period limited by the memory size.

[0015] In a particularly advantageous embodiment of the invention, the second operating state of the motor vehicle is a charging state, in which the battery of the motor vehicle is charged at a power source external to the motor vehicle. Thus, in this case, the motor vehicle is an electric vehicle. For example, the battery can be designed as a high-voltage battery. The power source external to the motor vehicle can be, for example, a public charging post or a private wall box. Here, the electric vehicle must be regularly connected to such a battery charging system, which usually means being connected to a power source external to the vehicle. This enables advantageous regular monitoring of data communication and attack detection. Another very great advantage of this embodiment is that, while such an electric vehicle is located in such a charging system or is connected to it for charging, in principle no driving operation can be carried out, and usually no driving operation can be carried out for a relatively long period of time. In particular, in the case of purely electric vehicles, the charging process usually lasts long enough to analyze the stored data, more precisely the first part of the data, with the aid of an attack detection system. Now it is advantageous that the computing power available during the charging process can be used to analyze previously recorded or stored vehicle data or network data by the attack detection system. Here, due to the length of time of a typical charging process, there is almost no risk that the analysis method must be terminated prematurely when resuming driving operation. Furthermore, the computationally intensive operations performed by the attack recognition system also require energy, which can advantageously be easily provided by an external power source during the charging process without taxing the vehicle's internal battery and thereby reducing the vehicle's range.

[0016] It is also conceivable that the motor vehicle can additionally or alternatively carry out the described analysis method in another second operating state, for example when the motor vehicle is only parked but not charged. However, this is less preferred because it is not always possible to ensure that the motor vehicle is parked long enough for the analysis to take place, and on the other hand, the analysis requires a relatively large amount of energy, which would result in a reduction in the driving range of the vehicle at rest.

[0017] Therefore, the first operating state is an operating state that is preferably different from the charging process of the motor vehicle. In principle, any other operating state of the motor vehicle that is different from the charging state is conceivable, such as a driving operating state of the motor vehicle.

[0018] According to another advantageous design of the present invention, the controller of the motor vehicle performs a certain function in a first operating state, while in a second operating state, the controller does not perform the certain function and analyzes the first part of the data at least partially as part of the attack recognition system. Preferred controllers are those with the largest possible computing power. Such controllers are, for example, the gateway of the motor vehicle and / or the infotainment controller of the motor vehicle, the controller for the driver assistance system or other controllers. However, in principle, other controllers can also be used alternatively or additionally. During the charging process or generally when the motor vehicle is stationary and when the motor vehicle is not in driving operation, the controller usually does not perform functions, or performs significantly fewer functions, so it does not require as much computing power as when driving, and can therefore be advantageously used as part of the attack recognition system in the second operating state for data analysis. Here, the data, more precisely the first part of the stored data, can be analyzed by a single controller or multiple controllers of the motor vehicle.

[0019] In another very advantageous embodiment of the invention, the basic attack recognition system analyzes the second part of the data of the data communication, in particular continuously or continuously, at least in the first operating state. Here, the computing power required for the basic attack recognition system is significantly less, so it can advantageously be operated in any active / activated operating state. Here, the second part of the data of the data communication is a limited subset of the total data communication. Therefore, the second data is not first stored and then analyzed, but analyzed in real time. Therefore, even in the first operating state, a certain monitoring function can be provided to monitor the data communication to a reduced extent. However, the additional basic attack recognition system has other great advantages, which will be explained in detail later.

[0020] According to another very advantageous embodiment of the invention, the data of the data communication are continuously stored in the ring memory / cyclic memory until a predetermined event occurs, wherein the data stored in the ring memory when the predetermined event occurs represents the first part of the data. Thus, the data of the data communication are stored in the ring memory until the storage space provided by the ring memory is full. Then, the old data in the ring memory are replaced or overwritten by the new data of the data communication. This replacement is preferably carried out in such a way that, when the predetermined event occurs, the latest data of the data communication are stored in the ring memory. Thus, the latest data are related to the time period of the data communication just before the predetermined event occurs. For example, the size of the ring memory determines the size of the time period.

[0021] In a very advantageous embodiment of the invention, the predetermined event is the detection of the second operating state. For example, once the charging state is detected, the storage of the data of the data communication in the ring memory can be terminated and the data stored as the first part of the data can now be analyzed by the attack recognition system in the second operating state.

[0022] In another advantageous design of the present invention, the predetermined event indicates that a data anomaly is detected by the basic attack recognition system of the motor vehicle. For example, if the basic attack recognition system detects signs of an attack, the data that has been collected can be frozen in the ring memory, that is, to prevent further overwriting of the data, and then further analysis can be performed in the second operating state. In this case, the second data analyzed by the basic IDS and the first data analyzed by the attack recognition system in the second operating state, or more precisely, the first part of the data, can partially overlap. Therefore, the data classified as abnormal by the basic IDS in the first operating state can be analyzed in a targeted manner by the attack recognition system in the second operating state. Another great advantage of the basic attack recognition system is reflected here, because it can be used to analyze data with anomalies in a targeted manner by the attack recognition system in the second operating state. This further increases the probability of identifying an attack.

[0023] In another advantageous embodiment of the invention, if the attack recognition system detects at least one determined anomaly when analyzing the first part of the data, the attack recognition system transmits the first part of the data at least partially to a central data processing device outside the motor vehicle. The central data processing device can be an Internet server, i.e. a server connected via the Internet, also referred to as a backend server. The data transmission is therefore preferably carried out via the Internet. In this case, such a central data processing device usually also has a more powerful computing power and can perform a more detailed analysis of the received data. In addition, the central data processing device can also collect data from a plurality of different motor vehicles, compare these with each other, and use the comparison to perform attack recognition. Reliability can thus be increased again in addition.

[0024] Here, it is particularly advantageous to transmit the first part of the data to the central data processing device by means of an Internet connection provided by an external power source. A particularly broadband end-to-end encrypted data exchange with the back-end IDS can be advantageously achieved by connecting via the charging infrastructure. Therefore, the motor vehicle, or more precisely the attack identification system, can communicate with the central data processing device via the external energy source and the Internet connection provided by it, and transmit data to the central data processing device. Here, if the external energy source is designed as a public charging pile, for example, the data transmission from the motor vehicle to the central data processing device can be carried out through the charging pile. Here, the motor vehicle can transmit the data to the charging pile wirelessly or wired, in particular through a charging connection for charging the battery of the motor vehicle. However, even if the external energy source is designed as a private wall box, for example, the data can be transmitted from the motor vehicle to the central data processing device in a similar manner to the communication connection with the home network structure. For example, it is conceivable that the motor vehicle is connected to the home network structure via WLAN communication.

[0025] By using an Internet connection provided by an external power source, significantly larger data volumes can advantageously be transmitted to a central data processing device in a shorter time than is possible, for example, via a conventional Internet connection of the motor vehicle itself. However, an Internet connection provided by an energy source can also be advantageously used for other purposes, for example, for adapting algorithms in the vehicle and / or for transmitting even larger data volumes of collected data to a backend and evaluating them. Thus, for example, software updates etc. can also be carried out and the algorithms of the IDS in the vehicle can be adapted.

[0026] As mentioned above, it is advantageous if the central data processing device is also designed to check the transmitted data and thus provide an attack recognition system. However, this is not mandatory. It is also conceivable that if the attack recognition system of the motor vehicle detects a specific anomaly when analyzing the first part of the data, the attack recognition system transmits this anomaly to the central data processing device. The central data processing device can record the detection of an attack or potential attack and trigger further functions or actions if necessary. The local evaluation of the first part of the data in the vehicle also has the great advantage that this also allows the use of data and data streams that are not suitable for transmission to the backend for reasons such as data protection. Another advantage is that the Internet connection provided by the external energy source can also be additionally protected by the vehicle's IDS.

[0027] As another solution, the present invention also includes a computer-readable storage medium, which includes a command, when the command is executed by a computer or a computer network, so that the computer or computer network performs an embodiment of the method according to the present invention. The storage medium can be, for example, at least partially designed as a non-volatile data storage device (e.g., flash memory and / or SSD-solid state hard disk, ordinary hard disk) and / or at least partially designed as a volatile data storage device (e.g., RAM-random access memory). The computer or computer network can provide a processor circuit with at least one microprocessor. The command can be provided as a binary code or an assembler and / or a source code of a programming language (e.g., C).

[0028] The invention also relates to a computer program product that can be executed on a computing unit, wherein the computer program product, when executed on a computing unit, causes the computing unit to execute a method according to the invention or one of its embodiments. The invention also relates to a data carrier on which a computer program product according to the invention or one of its embodiments is stored. The invention also relates to a computing unit having a data carrier according to the invention or one of its embodiments. A motor vehicle having such a computing unit according to the invention or one of its embodiments is also to be regarded as belonging to the invention.

[0029] The computing unit may have a data processing device or a processor device, which is configured to execute an embodiment of the method according to the invention. For this purpose, the processor device may have at least one microprocessor and / or at least one microcontroller and / or at least one FPGA (Field Programmable Gate Array) and / or at least one DSP (Digital Signal Processor). In addition, the processor device may have a program code, which is configured to execute an embodiment of the method according to the invention when executed by the processor device. The program code may be stored in a data memory of the processor device.

[0030] The invention also relates to a motor vehicle having an attack recognition system for monitoring data communications of a motor vehicle, wherein the attack recognition system for monitoring data communications is designed to analyze at least a portion of the data of the data communications. Here, the attack recognition system is designed to store a first portion of the data in a first operating state of the motor vehicle and to analyze the first portion of the stored data in a second operating state of the motor vehicle that is different from the first operating state and in which the motor vehicle is stationary rather than in driving operation.

[0031] The advantages described for the method according to the invention and its embodiments also apply to the motor vehicle according to the invention.

[0032] The invention also includes developments of the motor vehicle according to the invention which have the features already described in conjunction with the developments of the method according to the invention. For this reason, the corresponding developments of the motor vehicle according to the invention will not be described in detail here.

[0033] The motor vehicle according to the invention is preferably designed as a car, in particular a passenger car or a truck, or as a bus or a motorcycle.

[0034] The present invention also includes combinations of features of the described embodiments. Therefore, the present invention also includes implementations that respectively have a combination of features of a plurality of the described embodiments, unless these embodiments are described as mutually exclusive. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] The following describes an embodiment of the present invention.

[0036] Figure 1 A schematic diagram of a motor vehicle having an attack recognition system according to an embodiment of the present invention is shown, wherein the motor vehicle is in a first operating state of the motor vehicle; and

[0037] Figure 2 Shows Figure 1 Schematic diagram of a motor vehicle according to an exemplary embodiment of the present invention, which is in a second operating state. DETAILED DESCRIPTION

[0038] The embodiment of setting forth below is a preferred embodiment of the present invention. In the embodiment, the described composition of the embodiment represents each feature of the present invention that should be considered independently of each other, and these features also improve the present invention independently of each other. Therefore, the disclosure is also intended to include the combination except the shown combination of the feature of the embodiment. In addition, the described embodiment can also be supplemented by other features in the described feature of the present invention.

[0039] In the figures, the same reference numerals respectively denote elements with the same function.

[0040] Figure 1A schematic diagram of a motor vehicle 10 in a first operating state B1 according to an embodiment of the present invention is shown. Here, the motor vehicle 10 has an attack recognition system 12. The attack recognition system is used to monitor data communication, especially network communication, of the motor vehicle 10. A network 14 inside the motor vehicle is schematically shown here, and the network inside the motor vehicle can also be communicatively connected to a component 16 outside the motor vehicle and can exchange data with the component outside the motor vehicle, so that another network 18 is provided through the network 14 inside the motor vehicle and the external component 16.

[0041] Due to the limited computing power present in typical automotive systems, the computing power under normal driving conditions is not sufficient to implement a complete IDS system. Here, a complete IDS system analyzes the entire data communication of the network. The inability to implement such a complete IDS system results in potential vulnerabilities in identifying conceivable cyber attacks.

[0042] The present invention now advantageously makes it possible to significantly improve the reliability of such an attack recognition system 12. To this end, in a first operating state B1 of the motor vehicle 10, at least a first part of the data of the data communication of the network 14 or 18 (hereinafter also referred to as the first data D1 for short) is stored in the memory 20. The memory 20 can be designed, for example, so that the relevant data D1, that is, usually the network data, can be recorded, for example, at a fixed or predetermined time. The corresponding required storage space is provided by the memory 20. The memory 20 can be, for example, a ring memory. If the storage space of the ring memory 20 is full, for example, the older data is replaced by newer data. The first operating state B1 can, for example, represent the driving operation of the motor vehicle 10, as shown by the arrow 22.

[0043] Furthermore, the attack recognition system 12 comprises an analysis module 24 for analyzing the first data D1. However, as long as the motor vehicle 10 is in the first operating state B1, the analysis module 24 does not analyze the first data D1, because insufficient computing power is available at this time. The analysis module 24 can be part of a controller 26 of the motor vehicle 10, which also performs a further function F1 in the driving operating state B1. The controller 26 can be, for example, a gateway or an infotainment controller, or another controller, for example, for implementing a driver assistance function.

[0044] Figure 2 The second operating state B2 is shown. Figure 1Schematic diagram of a motor vehicle. In this case, the second operating state B2 is a charging process B2, in which a battery 28 of the motor vehicle 10, for example a high-voltage battery 28, is charged at a charging post 30 as an example of an external power supply for the motor vehicle. For this purpose, the motor vehicle 10 can be connected to the charging post 30 via a charging cable 32. Since the battery-operated vehicle 10 is usually located at a charging system (for example the charging post 30 shown here) due to the system, and driving operation is basically not possible at these locations, it is now advantageous to use the computing power that is now available to analyze the recorded vehicle data, that is, to analyze the stored first data D1, that is, typical network data in the sense of IDS.

[0045] Therefore, the first data D1 stored in the memory 20 can be transmitted to the analysis module 24 in the second operating state B2. Therefore, in the second operating state B2, the controller 26 including the analysis module 24 no longer executes the above-mentioned first function F1, but instead executes the second function F2, which includes analyzing the stored first data D1 for attack recognition. For example, the controller 26 is designed so that the software executed on the controller 26 can be switched. In other words, it is possible to switch between the first software for implementing the first function F1 and the software for implementing the second function F2. Here, the switching depends on the current operating state B1, B2. In other words, the switching between the normal operating mode, that is, the implementation of the first function F1 and the implementation of the IDS or IDS software according to the current operating state B1, B2 is selected, wherein in the second operating state B2, that is, in the charging state B2, the IDS software is implemented accordingly. This advantageously enables the implementation of a significantly more complex and reliable attack recognition analysis method, because now significantly more computing power can be used in the charging state B2 of the motor vehicle 10. For this, it is not necessary to increase the overall computing power in the vehicle 10. For this purpose, computing power of the controller 26 that is not used during charging can be used.

[0046] This advantageously enables a powerful intrusion detection system to be implemented even on a vehicle architecture designed with low computing power. In addition, this improves the detection capabilities of the IDS 12. The local evaluation in the vehicle can also make it possible to use data and data streams that are not suitable for transmission to the back end 34 for reasons such as privacy. In addition, another great advantage of carrying out attack detection of the charging process B2 is that the charging system, such as the charging post 30 in this example, usually also has an Internet connection 36. On the one hand, this makes it possible to achieve that this Internet connection 36 can also be protected by the IDS 12. However, a particularly great advantage is that the anomaly A that may be detected by the IDS 12 or even the first data D1 itself can be transmitted to the back end 34 assigned to the motor vehicle 10 via a broadband Internet connection 36. Here, the back end 34 can perform an attack detection based on the first data D1, which will be explained in more detail, because such a back end 34 that can be provided by an Internet server or server system can also provide significantly more computing power. In addition, the data of different vehicles can also be compared with each other, which also allows a more detailed and meaningful analysis. Preferably, the first data D1 is transmitted to the back end 34 only when the IDS 12 detects an anomaly or abnormality A (i.e., for example, signs of an attack, in particular a cyber attack). Unnecessary data transmission is thereby avoided. Therefore, a broadband, end-to-end encrypted data exchange with the back end IDS 34 can be achieved via the connection 36 via the charging infrastructure 30. In addition, the connection 36 can also be used, for example, to adapt the algorithms of the IDS 12 in the vehicle 10, for example in the form of software updates, etc. Here, for data transmission, the communication connection between the vehicle 10 and the charging post 30 can be achieved via the charging connection or the charging cable 32.

[0047] At this time, if a transition from the first operating state B1 or from another third operating state to the second operating state B2 is detected in the motor vehicle 10, an analysis of the data D1 stored in the memory 20 can be triggered. If the memory 20 is designed as a ring memory as described, the first data D1 represents the latest data. When the memory capacity is insufficient, older data is overwritten if necessary. Therefore, the stored first data D1 relates to data communication that occurred in a time period directly before the charging process B2. However, it is also conceivable to store data from other time periods in the memory 20 and then analyze the data accordingly in the second operating state B2. It is particularly advantageous here, as in Figure 1As shown, the motor vehicle 10 additionally has a basic IDS 38. The basic IDS continuously analyzes a subset of the data traffic of the network 18 or 14 at least in the first operating state B1 and in particular independently of the operating state, wherein the subset is shown here as second data D2. Here, the first data D1 and the second data D2 can also overlap or have a common intersection. Here, the first data can be said to represent all data of the data communication in the network 14 or 18 within a certain period of time, while the second data D2 only includes selected data of the data communication, but there is no time limit for this.

[0048] Furthermore, if such a basic IDS 38 has now detected an attack sign based on the second data D2, it is advantageous to freeze the data already collected in the ring buffer 20 and to transmit the data to the IDS 12 for further analysis as soon as the motor vehicle 10 is in the second operating state B2. Freezing here means that the data stored in the memory 20 will not be further overwritten at the time of freezing.

[0049] While such a system cannot replace a full IDS, in many cases this approach combined with widespread deployment across fleets can help identify attacks and take appropriate countermeasures.

[0050] In summary, the examples demonstrate that IDS operations can be performed by the present invention in particular operating states, in particular during charging.

Claims

1. A method for monitoring data communications of a motor vehicle (10) by means of an attack recognition system (12), wherein: An attack recognition system (12) for monitoring data communication analyzes at least a first portion (D1) of data in the data communication; it is characterized in that the first portion (D1) of the data is stored in a first operating state (B1) of the motor vehicle (10), and in a second operating state (B2) of the motor vehicle (10) different from the first operating state, the motor vehicle (10) is in a stationary state and is not in driving operation, and in this second operating state, the first portion (D1) of the stored data is analyzed by the attack recognition system (12).

2. The method according to claim 1, characterized in that A second operating state (B2) of the motor vehicle (10) is a charging state (B2), in which a battery (28) of the motor vehicle (10) is charged at a power source (30) external to the motor vehicle.

3. The method according to any one of the preceding claims, characterized in that A controller of a motor vehicle (10) performs a certain function (F1) in a first operating state (B1), but does not perform the certain function (F1) in a second operating state (B2) and performs at least a part of an analysis (F2) of a first part of the data (D1) as part of an attack recognition system (12).

4. The method according to any one of the preceding claims, characterized in that The basic attack recognition system (38) analyzes, at least in a first operating state (B1), a second portion (D2) of the data of the data communication, in particular permanently or continuously.

5. The method according to any one of the preceding claims, characterized in that Data of the data communication are continuously stored in a ring memory (20) until a predetermined event occurs, wherein the data stored in the ring memory (20) when the predetermined event occurs constitutes a first portion (D1) of the data.

6. The method according to claim 5, characterized in that The predetermined event is the detection of a second operating state (B2).

7. The method according to claim 5 or 6, characterized in that: The predetermined event is a data anomaly detected by a basic attack recognition system (38) of the motor vehicle (10).

8. The method according to any one of the preceding claims, characterized in that If the attack recognition system (12) detects at least one determined anomaly when analyzing the first part (D1) of the data, the attack recognition system (12) transmits the first part (D1) of the data at least partially to a central data processing device (34) outside the motor vehicle.

9. The method according to any one of the preceding claims, characterized in that A first portion (D1) of the data is transmitted to a central data processing device (34) by means of an Internet connection (36) provided by an external power source (30).

10. A motor vehicle (10) having an attack recognition system (12) for monitoring data communications of the motor vehicle (10), wherein: In order to monitor data communication, the attack recognition system (12) is designed to analyze at least a first part (D1) of the data of the data communication; it is characterized in that the attack recognition system (12) is designed to store the first part (D1) of the data in a first operating state (B1) of the motor vehicle (10), and in a second operating state (B2) of the motor vehicle (10) different from the first state, the motor vehicle (10) is in a stationary state and not in driving operation, and in this second operating state, an analysis (F2) of the stored first part (D1) of the data is performed.

Images