Real-time active threat validation mechanism for vehicle computer systems

A method comprising using at least one hardware processor of a vehicle system for:

• receiving a message comprising data of a suspicious message that was flagged as suspicious by an electronic control unit (ECU) of multiple ECUs of the vehicle system, wherein each of the ECUs comprises a security module configured to:
• (a) flag a suspicious message received by the ECU, the suspicious message being suspected to be an attempt to interfere with functions of the ECU, and (b) transmit a message that comprises data of the suspicious message;
• generating a query to determine authenticity of the suspicious message, wherein the query is directed only to one or more relevant ECUs of the multiple ECUs, wherein the one or more relevant ECUs are ones which typically generate messages that are similar or identical to the data of the suspicious message, and wherein the query requires each of the one or more relevant ECUs to respond by indicating if it is the one which transmitted the suspicious message;
• broadcasting the query via a controller area network (CAN) bus to the one or more relevant ECUs;
• listening, for a predetermined period of time, for responses to the query from the one or more relevant ECUs;
• and
• determining that the suspicious message is an actual threat if one of the following holds true:
• (a) the one or more relevant ECUs responded, within the predetermined period of time, that they did not transmit the suspicious message, and (b) the threat detection module determines that CAN bus jamming is ongoing because no response has been received from the one or more relevant ECUs within the predetermined period of time.

A computer program product comprising a non-transitory computer-readable storage medium having program code embodied therewith, the program code executable by at least one hardware processor to:

• receive a message comprising data of a suspicious message that was flagged as suspicious by an electronic control unit (ECU) of multiple ECUs of a vehicle system, wherein each of the ECUs comprises a security module configured to:
• (a) flag a suspicious message received by the ECU, the suspicious message being suspected to be an attempt to interfere with functions of the ECU, and (b) transmit a message that comprises data of the suspicious message;
• generate a query to determine authenticity of the suspicious message, wherein the query is directed only to one or more relevant ECUs of the multiple ECUs, wherein the one or more relevant ECUs are ones which typically generate messages that are similar or identical to the data of the suspicious message, and wherein the query requires each of the one or more relevant ECUs to respond by indicating if it is the one which transmitted the suspicious message;
• broadcast the query via a central access network (CAN) bus to the one or more relevant ECUs;
• listen, for a predetermined period of time, for responses to the query from the one or more relevant ECUs;
• and
• determine that the suspicious message is an actual threat if one of the following holds true:
• (a) the one or more relevant ECUs responded, within the predetermined period of time, that they did not transmit the suspicious message, and (b) the threat detection module determines that CAN bus jamming is ongoing because no response has been received from the one or more relevant ECUs within the predetermined period of time.