Vehicle safety

Abstract

The present disclosure provides "vehicle security." In a vehicle, combined data is monitored to detect anomalies in the combined data. The combined data includes data from outside the vehicle and vehicle network data. In response to failing to identify the anomaly, the anomaly is transmitted from the vehicle to a cloud computer via a wide area network. Upon failing to identify the anomaly transmitted from the vehicle computer in the cloud computer, the data is input to a classifier. Upon the classifier outputting a threat determination, the cloud computer can transmit vehicle operation commands to the vehicle computer via the wide area network.

Description

Technical Field

[0001] This disclosure includes technologies for enhanced safe operation of vehicles in communication and control. Background Technology

[0002] Connected vehicles (i.e., vehicles that communicate via networks outside the vehicle, such as so-called software-defined vehicles (SDVs)) face security challenges. These challenges are expected to increase as the deployment of edge computing devices and other technologies in vehicles grows, and as vehicles become more integrated with wide-area digital networks. For example, unauthorized users or devices may attempt to access vehicle data and / or the vehicle itself. Summary of the Invention

[0003] A vehicle computer can monitor one or more vehicle networks, as well as data received from one or more sources outside the vehicle. For example, various controllers, sensors, or computers can provide data on the vehicle network. User devices such as key fobs and smartphones can communicate with the vehicle computer from outside the vehicle, typically wirelessly. Monitoring data on the vehicle network and from external sources, the vehicle computer can detect anomalies in the data (i.e., values ​​that are not expected or defined for normal or typical operation of the vehicle). Anomalies can indicate vehicle problems or concerning situations, such as security threats, such as an unauthorized user attempting to access the vehicle. Upon detecting an anomaly, the vehicle computer can attempt to identify it and, if identified, take a response action. If the vehicle computer cannot identify the anomaly, it can transmit it to a cloud computing system, which may be able to identify the anomaly and / or take a response action.

[0004] A system includes a vehicle computer comprising a first processor and a first memory, the first memory storing instructions executable by the first processor to monitor data comprising a combination of data from outside the vehicle and vehicle network data to detect anomalies in the combined data; and to transmit the anomaly via a wide area network in response to failure to identify the anomaly. The system also includes a cloud computer comprising a second processor and a second memory, the second memory storing instructions executable by the second processor to input the data to a classifier after failure to identify the anomaly transmitted from the vehicle computer; and to transmit vehicle operation commands via the wide area network after the classifier outputs a threat determination.

[0005] The vehicle computer or second vehicle computer may include instructions for controlling vehicle components in response to vehicle operation commands. The vehicle components may be windows, doors, lights, speakers, steering, braking, or propulsion. The vehicle computer or second vehicle computer may include instructions for controlling vehicle components in response to recognizing the anomaly. The vehicle computer may monitor various media to monitor data from outside the vehicle. The anomaly may be an unidentified Controller Area Network (CAN) signal or Ethernet network message. The anomaly may be an unidentified security key. The anomaly may be a data value outside the specified range.

[0006] The cloud computer can store additional instructions for: transmitting the unknown anomaly determination to the incident manager after the classifier outputs an unknown anomaly determination; updating the classifier to recognize the unknown anomaly determination after the classifier outputs an unknown anomaly determination; and transmitting vehicle operation commands via the wide area network after receiving the anomaly from the vehicle computer, recognizing the anomaly and determining the threat, and without outputting the anomaly to the classifier.

[0007] A method includes monitoring data comprising a combination of data from outside the vehicle and vehicle network data to detect anomalies in the combined data; transmitting the anomaly from the vehicle to a cloud computer via a wide area network in response to failure to identify the anomaly; inputting the data to a classifier after the anomaly transmitted from the vehicle is not identified in the cloud computer; and transmitting vehicle operation commands from the cloud computer to the vehicle via the wide area network after the classifier outputs a threat determination.

[0008] The method may further include a vehicle computer controlling vehicle components in response to the vehicle operation commands. The vehicle components may be windows, doors, lights, speakers, steering, braking, or propulsion. The method may also include controlling the vehicle components in response to recognizing the anomaly. Monitoring the combined data may include monitoring multiple media to monitor data originating from outside the vehicle. The anomaly may be an unidentified Controller Area Network (CAN) signal or Ethernet network message, an unidentified security key, and / or out-of-range data values.

[0009] The method may further include transmitting the unknown anomaly determination to an incident manager after the classifier outputs the unknown anomaly determination. The method may further include updating the classifier to recognize the unknown anomaly determination after the classifier outputs the unknown anomaly determination. The method may further include transmitting the vehicle operation command from the cloud computer via the wide area network after receiving the anomaly from the vehicle computer, recognizing the anomaly and the threat determination, and without outputting the anomaly to the classifier. Attached Figure Description

[0010] Figure 1 This is a diagram of an example vehicle system.

[0011] Figure 2 It provides Figure 1 A block diagram showing further details of the system.

[0012] Figure 3 This is a flowchart illustrating an example process for vehicle safety. Detailed Implementation

[0013] Figure 1 An example system 100 for a vehicle 105 is shown. One or more computers (such as one or more electronic control modules (ECMs) 110) may be provided to control one or more vehicle operations, including steering 145, propulsion 135 (i.e., controlling acceleration or speed) and / or braking 140. Therefore, system 100 is shown as including vehicle 105, which may include driver assistance system (DAS) features. Vehicle computer 110 (in...) Figure 1 The entirety of the term represents one or more vehicle electronic control modules (ECMs) 110 or electronic control units (ECUs) that can be configured to operate the vehicle 105 independently of the occupants’ operation of certain features.

[0014] In addition to controlling speed and steering as mentioned above, the ECM 110 can also be used to control the operation of vehicle components such as ignition or starter, windows, doors, seats, etc. Therefore, the ECM 110 can provide driver assistance systems (DAS), such as cruise control (where the computer maintains the vehicle speed according to a set speed), adaptive cruise control (ACC) (where the computer adjusts the vehicle speed according to a set speed, but may be based on the detected distance and / or speed of other vehicles), and / or hands-free driving. For example, the ECM 110 can provide hands-free driving in conjunction with ACC, allowing the ECM 110 to control steering, braking, and acceleration. In another example, the ECM 110 can provide ACC and require manual operation. The ECM 110 can be programmed to operate the propulsion 135, braking 140, steering 145, the display screen of the human-machine interface (HMI) 150, and / or other vehicle systems.

[0015] ECM 110 can be configured to wirelessly communicate with user device 125 (e.g., key fob, smartphone, etc.) and is arranged to communicate with other ECMs 110, sensors 115, etc., on a wired or wireless vehicle network 114. Vehicle network 114 may include, for example, conventional vehicle communication buses (such as Controller Area Network (CAN) bus, Local Area Network (LIN) bus, etc.) and / or other wired and / or wireless technologies (e.g., Bluetooth®, WIFI®, Ethernet, UWB, etc.). Via network 114, ECM 110 can transmit messages to and / or receive messages from various devices in vehicle 105 (e.g., sensors 115, controllers, and actuators (not shown)).

[0016] Alternatively or additionally, for example, in cases where computer 110 actually comprises multiple devices (e.g., multiple ECMs 110), the vehicle network can be used for communication between computing devices such as ECMs 110. As described above and further discussed below (see [link to documentation]). Figure 2 Various ECMs 110 can be provided in vehicle 105 for specific features or operations, such as safety, telematics, and control of body components (such as windows and doors).

[0017] For example, the ECM 110 described herein may be a general-purpose computer with a processor and memory and / or may include special-purpose electronic circuitry, including application-specific integrated circuits (ASICs) manufactured for specific operations, such as ASICs for processing and / or transmitting sensor data. In another example, the ECM 110 may include a field-programmable gate array (FPGA), which is an integrated circuit manufactured as a user-configurable component. Typically, hardware description languages ​​such as the Very High Speed ​​Integrated Circuit Hardware Description Language (VHDL) are used in electronic design automation to describe digital and mixed-signal systems such as FPGAs and ASICs. For example, an ASIC is manufactured based on VHDL programming provided before manufacturing, while the logic components within an FPGA may be configured based on VHDL programming, for example, stored in memory electrically connected to the FPGA circuitry. In some examples, a combination of processor, ASIC, and / or FPGA circuitry may be included in the computer 110.

[0018] Additionally, the ECM 110 (e.g., ECM 110-TCU) can be programmed to communicate with a network and / or external devices (not shown), which may include various wired and / or wireless networking technologies such as cellular, Bluetooth®, Bluetooth Low Energy® (BLE), wired and / or wireless packet networks, etc.

[0019] The memory of computer 110 can be of any suitable type, such as a hard disk drive, solid-state drive, server, or any volatile or non-volatile media. The memory can store collected data transmitted from sensor 115. The memory can be a separate device from ECM 110, and ECM 110 can retrieve the data stored in the memory via a network in vehicle 105 (e.g., via CAN bus, wireless network, etc.). Alternatively or additionally, the memory can be part of ECM 110, for example, as the memory of ECM 110.

[0020] Sensor 115 may include various means configured to acquire data from or about the environment of vehicle 105. For example, various controllers or ECMs 110 in vehicle 105 may act as sensors 115 to provide data, such as data related to vehicle speed, acceleration, position, subsystem and / or component status, via a vehicle network or bus. Furthermore, other sensors 115 may include cameras, motion detectors, etc., for example, sensors 115 may provide data to assess component status, assess road gradient, etc. Sensor 115 may also include, but is not limited to, short-range radar, long-range radar, light detection and ranging (LIDAR), ultrasonic sensors, etc. Cameras are typically optical cameras, such as those in the visible spectrum, but may alternatively or additionally include other types of cameras, such as time-of-flight cameras, infrared cameras, etc.

[0021] The collected data may include a variety of data collected in vehicle 105. Examples of collected data are provided above. Data is typically collected using one or more sensors 115 and may additionally include data calculated from them in ECM 110. Typically, the collected data may include any data acquired by sensor 115 and / or calculated from this data.

[0022] Vehicle 105 may include multiple vehicle components. In this context, vehicle components include one or more physical parts adapted to perform mechanical functions or operations—such as moving vehicle 105, slowing or stopping vehicle 105, steering vehicle 105, defining the vehicle compartment (e.g., doors or windows are components), protecting the vehicle compartment (e.g., door locks or latches), etc. Non-limiting examples of components include: propulsion components 135 (which include, for example, an internal combustion engine and / or an electric motor), transmission components, steering assemblies (e.g., which may include one or more of a steering wheel, steering rack, etc.), braking components 140, parking assist components, adaptive cruise control components, adaptive steering components 145, movable seats, etc. Components may include computing devices, such as electronic control units (ECMs) and / or computing devices such as those described above with respect to ECM 110, and they also communicate via a vehicle network.

[0023] HMI 150 typically includes one or more of a display, a touchscreen display, a microphone, and a speaker. Users can provide input to devices such as ECM 110 via HMI 150. HMI 150 can communicate with ECM 110 via a vehicle network; for example, HMI 150 can send messages to ECM 110 including user input provided via a touchscreen, microphone, gesture-capturing camera, etc., and / or can display output, for example, via a screen, speaker, etc.

[0024] like Figure 2 As shown, the ECM (or communication module) 110-TCU (sometimes referred to as a telematics control unit) can provide a vehicle-to-vehicle communication module or interface to communicate with devices outside the vehicle 105 (e.g., via vehicle-to-vehicle (V2V) or vehicle-to-infrastructure (V2X) wireless communications (cellular and / or short-range radio communications, etc.) with another vehicle and / or with a remote server computer 165 (typically via direct radio frequency communication)). The communication module ECM 110-TCU may include one or more mechanisms available to the vehicle's computer for communication, such as transceivers, any desired combination of wireless (e.g., cellular, wireless, satellite, microwave, and radio frequency) communication mechanisms, and any desired network topology (or multiple topologies when multiple communication mechanisms are used). Exemplary communications provided via the ECM 110-TCU include cellular, Bluetooth, IEEE 802.11, Dedicated Short-Range Communications (DSRC), cellular V2X (CV2X), and / or wide area networks (WANs) including the Internet, providing data communication services. The label “V2X” is used herein for communication, which may be vehicle-to-vehicle (V2V) and / or vehicle-to-infrastructure (V2I) and may be provided by the communication module 110-TCU according to any suitable short-range communication mechanism (e.g., DSRC, cellular, etc.).

[0025] Network 160 represents one or more mechanisms by which vehicle computer 110 can communicate with remote computing devices (e.g., remote server computer 165, another vehicle computer, infrastructure element 140, etc.). Therefore, network 160 can be one or more of various wired or wireless communication mechanisms, including any desired combination of wired (e.g., cable and fiber optic) and / or wireless (e.g., cellular, wireless, satellite, microwave, and radio frequency) communication mechanisms, and any desired network topology (or multiple topologies when using multiple communication mechanisms). Network 160 is often referred to as a "wide area network" (WAN) because it facilitates communication between geographically distant devices. Components or subnets of a WAN include wireless communication networks (e.g., using Bluetooth®, Bluetooth® Low Energy (BLE), IEEE 802.11, vehicle-to-vehicle (V2V) such as Dedicated Short Range Communication (DSRC), etc.), local area networks (LANs), and / or WANs including the Internet.

[0026] Figure 2 This is a block diagram of the components of system 100, including various ECMs 110 that may be included in vehicle 105. These include ECM 110-BUNs that can wirelessly communicate with user device 125, such as via Bluetooth, ultra-wideband (UWB), and / or near-field communication (NFC). Furthermore, the ECM-110-BUN can communicate via vehicle network 114 with devices including, for example, other ECMs 110 (including ECM110-SM, ECM 110-VCM, ECM 110-CCZM, and ECM 110-TCU).

[0027] ECM 110-SM is a security module that can authenticate or authorize a user and / or device 125 seeking access to and / or control of vehicle 105. Authentication means verifying the identity of the user or device 125. Authorization means determining permission for the user or device 125 to access one or more features and / or components of vehicle 105 (e.g., opening a door, starting the vehicle, moving the vehicle, etc.). For example, device 125 can be authenticated and then authorized to start and / or unlock vehicle 105. Furthermore, ECM 110-SM can be configured to detect anomalies in data received via vehicle network 114, such as from ECM-110 BUN, ECM 110-VCM, ECM 110CCZM, and / or some other ECM 110. ECM 100-VCM is a vehicle control module, etc., that can process input to start and / or move the vehicle, for example, when the authenticated and authorized device 125 provides input for starting the vehicle. The ECM 110-CCZM (sometimes referred to as the zone control module or body control module) can process inputs to actuate vehicle body parts 105 and / or other components, such as doors, windows, etc.

[0028] Figure 2 Accordingly, the system elements are described, wherein a vehicle computer (such as ECM 110-SM and / or other ECM 110) monitors combined data, including data from outside vehicle 105 and data monitored on vehicle network 114, to detect anomalies in the combined data. Data from outside the vehicle may be detected via one or more media (such as Bluetooth, UWB, NFC, etc.). In the context of this disclosure, anomaly means unidentified (i.e., unexpected or undefined) data. Non-limiting examples of anomalies include the following: An anomaly may be an unidentified data point or data on network 114, such as an unidentified Controller Area Network (CAN) signal. Alternatively or additionally, an anomaly may be (e.g., received from device 125 attempting to access vehicle 105) an unidentified security key. Further alternatively or additionally, an anomaly may be an out-of-range data value. For example, computer 110 may store expected ranges for data values ​​(such as the speed of vehicle 105) acquired on vehicle network 114 (e.g., CAN signals or in Ethernet network messages); anomalies may be detected when the speed is greater than the expected value and / or outside the expected range (e.g., in an example implementation, a vehicle speed of 500 kilometers per hour (kPH) may lead to the detection of an anomaly).

[0029] An anomaly may or may not be identified by a computer receiving data including the anomaly (such as ECM 110-SM, server 165, etc.). An identified anomaly is one where unexpected or undefined data matches a stored anomaly value (i.e., equal to a stored anomaly value or within a range of stored anomaly values); an unidentified anomaly is one that does not match a stored anomaly value. An anomaly may be identified by one computer but not by another. For example, a computer in a vehicle (such as ECM 110-SM) may store a smaller set of anomalies for identification than a cloud computer (such as server 165). When a vehicle computer cannot identify an anomaly, such as because the anomaly is not stored in the vehicle (such as ECM 110-SM), this situation can be referred to as the vehicle computer failing to identify the anomaly. When a vehicle computer cannot identify an anomaly, it may transmit the anomaly via network 160 in response to its failure to identify the anomaly, whereby the anomaly may be received by server 165. In addition, anomalies detected by the vehicle computer can be recorded in the vehicle (e.g., in memory associated with WCH 110-SM) and can also be transmitted via WAN 160 for reception by server 165. However, such transmission may not occur in real time or near real time; real-time or near real-time transmission is typical after anomalies have failed to be identified.

[0030] A cloud computer, such as one or more servers 165 (one server 165 is shown in the example), can receive anomalies (e.g., in real-time or near real-time) from a computer in vehicle 105. As explained above, server 165 can determine whether anomalies are recognized or not, including recognizing anomalies not recognized in the vehicle's computer. Upon recognizing an anomaly not recognized by the computer in vehicle 105, server 165 can provide vehicle operation commands to vehicle 105 in response. Server 165 can also transmit vehicle operation commands via a wide area network based on the output from a classifier. For example, after failing to recognize anomalies transmitted from the vehicle's computer, server 165 can input anomaly data into a classifier, which can recognize the anomaly, output operation commands, and / or output a threat determination.

[0031] Threat determination in this document refers to identifying threats or risks to vehicle 105 and / or its users based on anomaly identification. For example, threat determination may specify that the vehicle is at risk of theft (e.g., because the identified anomaly indicates that a door or window has been broken, or the identified anomaly indicates that the ECM 110-SM has detected one or more unintended security keys and therefore an unauthorized user may be attempting to access the vehicle, or the identified anomaly indicates that vehicle 105 is in an unexpected location or is being driven at an unusual speed), vehicle malfunction, etc.

[0032] Vehicle operation commands are commands used to control (e.g., actuate) components of vehicle 105. Vehicle computers such as ECM 110-SM and / or other vehicle computers such as ECM 110-VCM and / or ECM 110-CCZM may include program instructions for controlling vehicle components in response to vehicle operation commands. As explained above, components may be various parts or collections of parts (e.g., vehicle systems or subsystems), such as doors, lights, speakers, HMI 150, steering 145, braking 140, or propulsion 135. Vehicle operation commands may be associated with one or more threat determinations. For example, computers 110, 165 may store lookup tables, etc., specifying operation commands to be executed in vehicle 105 after a threat determination. For example, one or more operational commands such as "lock push," "lock door," "activate lights," and "activate HMI" can be specified for various security vulnerability threats, such as an unauthorized device 125 attempting to access vehicle 105 (e.g., indicated by one or more incorrect security keys detected by ECM 110-SM), or an indication that a door is opened. Activating HMI 150 in response to a threat determination may include, for example, specifying a threat, such as the presence of a user attempting to "intrude" into vehicle network 114, via tactile, audio, or visual output.

[0033] Vehicle computers such as ECM 110-SM can identify anomalies upon detection. Furthermore, the vehicle computer (e.g., ECM 110-AM) or a second vehicle computer (e.g., ECM 110-VCM and / or ECM 110-CCZM) may include instructions for controlling vehicle components (e.g., executing vehicle operation commands) in response to identifying anomalies and / or in response to threat determination and / or vehicle operation commands from a cloud computing system (e.g., server 165).

[0034] As mentioned above, server 165 can provide anomalies (i.e., including one or more data values ​​identified as anomalies) to the classifier. In the context of this disclosure, a classifier can include machine learning programs that classify, categorize, or identify input data. For example, a neural network can be trained to output an anomaly based on input data representing an anomaly, or an anomaly that the classifier cannot recognize or identify. After initial training and implementation, the classifier can be continuously updated. For example, if an anomaly is not identified in the output, it can be investigated and identified, for example, by a human user, and the classifier can then be trained or updated to identify anomalies represented by the input data.

[0035] After the classifier outputs an unknown anomaly determination (i.e., an indication that the classifier cannot recognize an anomaly), the cloud computing system (e.g., including server 165) can transmit the unknown anomaly determination to the incident manager. The incident manager includes means or modules for logging or storing incidents (i.e., unknown anomaly determinations) for further investigation. As mentioned above, a human user can view the unknown anomaly determination and identify unknown (i.e., previously unrecognized) anomalies, and then update or train the classifier to identify or recognize future instances of the anomaly; that is, the classifier can be updated to recognize the unknown anomaly determination after it outputs the unknown anomaly determination.

[0036] As mentioned above, server 165 may store identifiers of anomalies not stored in vehicle 105 by ECM 110, etc. For example, vehicle 105 may be periodically updated with newly identified anomalies, and may experience an anomaly after server 165 has been updated to identify the anomaly but before the anomaly has been provided to vehicle 105. Furthermore, ECM 110 memory may be limited, and therefore vehicle 105 may only store (e.g., based on empirical analysis of reported anomalies for a specific type of vehicle 105 (e.g., size, propulsion type, brand, and / or model, etc.)) anomalies determined to have previously occurred in vehicles of that type and / or anomalies most relevant to vehicle 105 and / or anomalies most relevant to the location of vehicle 105 (e.g., the geographical area in which vehicle 105 is operating). When it is determined that an anomaly has occurred in vehicle 105 and / or other vehicles 105 of the same or similar type, vehicle 105 (e.g., the memory of ECM 110) may be updated to identify the anomaly, whether based on what is already stored in server 165 and / or based on the output from the classifier. Therefore, after receiving the anomaly from the vehicle computer and identifying the anomaly and the threat determination, the server 165 may transmit the threat determination and / or the vehicle operation command via the wide area network, with or without outputting the anomaly to the classifier.

[0037] Figure 3 This is a flowchart illustrating an example process 300 for vehicle safety. The various described process blocks may be executed in a different order than presented herein, and / or some blocks may be omitted and / or others may be added. The various blocks may be executed by a vehicle computer and / or a cloud computer, represented in the exemplary process 300 by an ECM 110-SM and a server 165, respectively. Process 300 is typically initiated and executed continuously after vehicle manufacturing, as long as sufficient power is available in the vehicle 105, even when the vehicle propulsion or ignition is in an "off" state. However, alternatively or additionally, process 300 may be initiated by other mechanisms, such as user input, detection of the vehicle being parked or off via the ECM-SM, etc.

[0038] Process 300 can begin in box 305, where the ECM 110-SM determines whether an anomaly has been detected. If yes, process 300 proceeds to box 310. If no, process 300 proceeds to box 355.

[0039] In box 310, the ECM 110-SM determines whether the detected anomaly is identifiable, for example, by consulting a lookup table listing anomalies associated with data types (e.g., security keys, CAN signals, etc.) and with expected or defined values ​​or ranges of values ​​for the data. If so, process 300 proceeds to box 335; however, if the ECM 110-SM cannot identify the detected anomaly, process 300 proceeds to box 315.

[0040] In box 315, the ECM 110-SM transmits detected anomalies to server 165 via WAN 160. For example, the ECM 110-SM may provide anomalies to the ECM 110-TCU via vehicle network 114, and the ECM 110-TCU may then send the anomalies to server 165 via network 160.

[0041] In box 320, following box 315, the ECM 110-SM determines, for example, whether the detected anomaly is identifiable by consulting a lookup table listing anomalies associated with data types (e.g., security keys, CAN signals, etc.) and with expected or defined values ​​or ranges of values ​​for the data. If the anomaly is identifiable, box 330 is then executed. Otherwise, process 300 proceeds to box 325.

[0042] In box 325, server 165 inputs the anomaly into the classifier as described above. If the classifier identifies the anomaly, process 300 proceeds to box 330. Otherwise, process 300 proceeds to box 345.

[0043] In box 330, which may follow one of boxes 320 and 325, server 165 determines threat identification and / or vehicle operation commands based on the identified anomaly, and transmits the anomaly, threat identification, and / or vehicle operation commands to vehicle 105 via WAN 160 (e.g., received by ECM 110-ECU and provided to ECM 110-SM).

[0044] In box 335, which may follow one of boxes 310 or 330, the ECM 110-SM resolves the identified anomaly. For example, a vehicle operation command may have been determined in association with the anomaly identified in box 310, or it may have been determined by server 165 and provided in box 330. Further alternatively or additionally, server 165 may have provided a threat determination, which the ECM 110-SM can then use to determine the vehicle operation command. After box 335, process 300 proceeds to box 355.

[0045] In box 345, following box 325, unidentified anomalies can be provided to the accident manager, etc., as described above. Furthermore, also as described above, newly identified anomalies can be used to train or update the classifier once identified, and / or vehicle 125 (e.g., ECM 110-SM) can be updated using newly identified anomalies and / or anomalies identified by server 165 (as in box 320) but not by ECM 110-SM.

[0046] After box 345, process 300 proceeds to box 350, or alternatively or otherwise (although process 300 is not shown in this way), box 345 may be omitted and / or box 350 may be performed before or concurrently with box 345.

[0047] In box 355, which can follow any of boxes 305, 335, or 350, it is determined whether process 300 should continue. For example, vehicle 105 may be completely de-energized, process 300 may be manually terminated by the user, and so on. In any case, if process 300 is to continue, then box 305 is executed next. Otherwise, process 300 ends after box 355.

[0048] Depending on the context, circumstances, and applicable laws, rules, and regulations, the systems and methods described herein may be modified and / or omitted. Furthermore, regardless of the actions that the vehicle (such as the computer controlling the vehicle) can take, users should exercise good judgment and common sense when operating the vehicle. The operations described herein should always be performed and / or carried out in accordance with the user manual and safety guidelines.

[0049] The computing device discussed herein (including computer 110) includes a processor and memory. Memory typically includes instructions executable by one or more processors of the computing device, such as the instructions disclosed above, and instructions for implementing frames or steps of the processes described above. Computer-executable instructions can be compiled or interpreted by computer programs created using a variety of programming languages ​​and / or techniques, including but not limited to Java™, C, C++, Visual Basic, JavaScript, Python, Perl, HTML, etc., in individual or combined forms. Generally, a processor (e.g., a microprocessor) receives and executes instructions, such as from memory, a computer-readable medium, etc., thereby causing one or more actions and / or processes to occur, including one or more of the processes described herein. Such instructions and other data can be stored and transferred using a variety of computer-readable media. A file in ECM 110 generally refers to a collection of data stored on a computer-readable medium such as a storage medium, random access memory, etc.

[0050] Computer-readable media includes any medium that contributes to providing data (e.g., instructions) that can be read by a computer. Such media can take many forms, including but not limited to non-volatile media, volatile media, etc. Non-volatile media include, for example, optical discs or magnetic disks and other persistent storage. Volatile media include dynamic random access memory (DRAM), which typically constitutes main memory. Common forms of computer-readable media include, for example, floppy disks, floppy disks, hard disks, magnetic tape, any other magnetic media, CD-ROMs, DVDs, any other optical media, punched cards, paper tape, any other physical media with a perforated pattern, RAM, PROMs, EPROMs, flash EEPROMs, any other memory chips or cassette tapes, or any other media from which a computer can read.

[0051] Regarding the media, processes, systems, methods, etc., described herein, it should be understood that although the steps of such processes, etc., have been described as occurring in an ordered sequence, such processes can be practiced by performing the described steps in an order different from that described herein. It should also be understood that some steps may be performed simultaneously, other steps may be added, or some steps described herein may be omitted. In other words, the description of systems and / or processes herein is provided to illustrate certain embodiments and should in no way be construed as limiting the disclosed subject matter.

[0052] Unless otherwise explicitly stated, “based on” means “at least partially based on”. Therefore, if A is “based on” B, it means that A can be determined entirely based on B, or it can be determined based on B and one or more other factors.

[0053] Therefore, it should be understood that this disclosure, including the foregoing description and drawings and the appended claims, is intended to be illustrative and not restrictive. Many embodiments and applications beyond the examples provided will be apparent to those skilled in the art upon reading the foregoing description. The scope of the invention should not be determined by reference to the foregoing description, but rather by reference to the appended and / or the claims included in the non-provisional patent applications thereon, together with the full scope of the equivalents of such claims. Future developments are envisioned and anticipated in the art discussed herein, and the disclosed systems and methods will be incorporated into such future embodiments. In conclusion, it should be understood that the disclosed subject matter is capable of modifications and variations.

[0054] Unless otherwise specified or required by the context, the article “a” modifying a noun should be understood to refer to one or more. The phrase “based on” covers being partially or entirely based on.

[0055] According to the present invention, a system is provided, the system comprising: a vehicle computer including a first processor and a first memory, the first memory storing instructions executable by the first processor to: monitor data including a combination of data from outside the vehicle and vehicle network data to detect anomalies in the combined data; and transmit the anomaly via a wide area network in response to failure to identify the anomaly; and a cloud computer including a second processor and a second memory, the second memory storing instructions executable by the second processor to: input the data to a classifier after failure to identify the anomaly transmitted from the vehicle computer; and transmit vehicle operation commands via the wide area network after the classifier outputs a threat determination.

[0056] According to an embodiment, the vehicle computer or the second vehicle computer may include instructions for controlling vehicle components in response to the vehicle operation commands.

[0057] According to an embodiment, the vehicle components are windows, doors, lights, speakers, steering, braking, or propulsion.

[0058] According to an embodiment, the vehicle computer or the second vehicle computer may include instructions for controlling vehicle components in response to recognizing the anomaly.

[0059] According to an embodiment, the vehicle computer monitors multiple media to monitor the data originating from outside the vehicle.

[0060] According to an embodiment, the anomaly is an unrecognized Controller Area Network (CAN) signal or Ethernet network message.

[0061] According to an embodiment, the anomaly is an unidentified security key.

[0062] According to an embodiment, the anomaly is a data value that is out of range.

[0063] According to an embodiment, the cloud computer stores additional instructions for transmitting the unknown anomaly determination to the incident manager after the classifier outputs an unknown anomaly determination.

[0064] According to an embodiment, after the classifier outputs an unknown anomaly determination, the classifier is updated to identify the unknown anomaly determination.

[0065] According to an embodiment, the cloud computer stores additional instructions for transmitting the vehicle operation command via the wide area network after receiving the anomaly from the vehicle computer, identifying the anomaly and determining the threat, and without outputting the anomaly to the classifier.

[0066] According to the present invention, a method includes: monitoring data comprising a combination of data from outside the vehicle and vehicle network data to detect anomalies in the combined data; transmitting the anomaly from the vehicle to a cloud computer via a wide area network in response to failure to identify the anomaly; inputting the data to a classifier after the anomaly transmitted from the vehicle is not identified in the cloud computer; and transmitting vehicle operation commands from the cloud computer to the vehicle via the wide area network after the classifier outputs a threat determination.

[0067] In one aspect of the invention, the method includes a vehicle computer controlling vehicle components in response to a vehicle operation command.

[0068] In one aspect of the invention, the vehicle component is a window, door, light, speaker, steering, braking, or propulsion.

[0069] In one aspect of the invention, the method includes controlling a vehicle component in response to recognizing the anomaly.

[0070] In one aspect of the invention, monitoring the combined data includes monitoring multiple media to monitor the data originating from outside the vehicle.

[0071] In one aspect of the invention, the anomaly is an unidentified Controller Area Network (CAN) signal or Ethernet network message, an unidentified security key, and / or an out-of-range data value.

[0072] In one aspect of the invention, the method includes transmitting the unknown anomaly determination to an incident manager after the classifier outputs an unknown anomaly determination.

[0073] In one aspect of the invention, the method includes updating the classifier to identify the unknown anomaly determination after the classifier outputs an unknown anomaly determination.

[0074] In one aspect of the invention, the method includes transmitting vehicle operation commands from the cloud computer via the wide area network after receiving the anomaly from the vehicle computer, identifying the anomaly and determining the threat, and without outputting the anomaly to the classifier.

Claims

1. A method comprising: Monitoring includes a combination of data from outside the vehicle and vehicle network data to detect anomalies in the combined data; In response to the failure to identify the anomaly, the anomaly is transmitted from the vehicle to the cloud computer via a wide area network; After the cloud computer fails to identify the anomaly transmitted from the vehicle, the data is input into the classifier; as well as After the classifier outputs a threat determination, the vehicle operation command is transmitted from the cloud computer to the vehicle via the wide area network.

2. The method of claim 1, further comprising a vehicle computer controlling vehicle components in response to the vehicle operation command.

3. The method of claim 1, wherein the vehicle component is a window, door, light, speaker, steering, braking, or propulsion.

4. The method of claim 1, further comprising controlling vehicle components in response to identifying the anomaly.

5. The method of claim 1, wherein monitoring the combined data includes monitoring multiple media to monitor the data from outside the vehicle.

6. The method of claim 1, wherein the anomaly is an unidentified Controller Area Network (CAN) signal or Ethernet network message, an unidentified security key, and / or an out-of-range data value.

7. The method of claim 1, further comprising, after the classifier outputs an unknown anomaly determination, transmitting the unknown anomaly determination to the incident manager.

8. The method of claim 1, further comprising updating the classifier to identify the unknown anomaly determination after the classifier outputs an unknown anomaly determination.

9. The method of claim 1, further comprising, after receiving the anomaly from the vehicle computer, identifying the anomaly and determining the threat, and without outputting the anomaly to the classifier, transmitting the vehicle operation command from the cloud computer via the wide area network.

10. A system comprising a vehicle computer and a cloud computer respectively programmed to perform the steps of any one of claims 1-9.

11. A vehicle comprising the vehicle computer as claimed in claim 10.

Images