Vehicle network intrusion detection system (IDS) using vehicle state predictions

An apparatus, comprising:

• one or more network interfaces to communicate with a network of a vehicle;
• a processor coupled to the network interfaces and configured to execute one or more processes;
• and
• a memory configured to store a process executable by the processor, the process when executed configured to:
• predict a state of the vehicle using a behavioral model comprising a Kalman filter, wherein the model is configured to predict the state of the vehicle based in part on one or more state variables that are available from one or more sub-systems of the vehicle and indicative of one or more physical characteristics of the vehicle, wherein the one or more sub-systems update the one or more state variables at different rates, further wherein the predicting is based on only portions of the model being updated at a given time;
• compute representation of a difference between the predicted state of the vehicle and a measured state of the vehicle indicated by one or more state variables available from the one or more sub-systems of the vehicle by computing a Kalman gain for the behavioral model, wherein the Kalman gain is:
• a covariance associated with the predicted state divided by a sum of a) the covariance associated with the predicted state and b) a covariance associated with the measured state;
• detect malicious intrusion of the vehicle based on the computed representation of the difference between the predicted state of the vehicle and the measured state of the vehicle exceeding a defined threshold;
• and
• initiate performance of a mitigation action for the detected intrusion, in response to detecting the malicious intrusion of the vehicle.

A tangible, non-transitory, computer-readable medium storing program instructions that cause a processor of a vehicle to execute a process comprising:

• predicting, by the processor of the vehicle, a state of the vehicle using a behavioral model comprising a Kalman filter, wherein the model is configured to predict the state of the vehicle based in part on one or more state variables that are available from one or more sub-systems of the vehicle and indicative of one or more physical characteristics of the vehicle, wherein the one or more sub-systems update the one or more state variables at different rates, further wherein the predicting is based on only portions of the model being updated at a given time;
• computing, by the processor, a representation of a difference between the predicted state of the vehicle and a measured state of the vehicle indicated by one or more state variables available from the one or more sub-systems of the vehicle by computing a Kalman gain for the behavioral model, wherein the Kalman gain is:
• a covariance associated with the predicted state divided by a sum of a) the covariance associated with the predicted state and b) a covariance associated with the measured state;
• detecting, by the processor, a malicious intrusion of the vehicle based on the computed representation of the difference between the predicted state of the vehicle and the measured state of the vehicle exceeding a defined threshold;
• and
• initiating, by the processor, performance of a mitigation action for the detected intrusion, in response to detecting the malicious intrusion of the vehicle.