# US 11,444,959 B2 · Integrated equipment fault and cyber attack detection arrangement

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,444,959 B2
- Document ID: US11444959B2
- Status: Granted
- Kind: B2
- Application number: 16/682,727
- Filed: 2019-11-13
- Published: 2021-08-19
- Granted: 2022-09-13
- Earliest claimed: 2018-12-21
- Assignees: Garrett Transportation I Inc.
- Applicants: Garrett Transportation I Inc.
- Inventors: Tim Felke; Rajneesh Kumar; Balaji Arumugam; Gwenaelle Cheramy
- Web page: https://patentgrep.com/patent/US11444959B2

## CPC

- H04L 63/1416: {Event detection, e.g. attack signature detection}
- G05B 23/0243: {model based detection method, e.g. first-principles knowledge model}
- G05B 23/0251: {Abstraction hierarchy, e.g. "complex systems", i.e. system is divided in subsystems, subsystems are monitored and results are combined to decide on status of whole system}
- G05B 23/0283: {Predictive maintenance, e.g. involving the monitoring of a system and, based on the monitoring results, taking decisions on the maintenance schedule of the monitored system; Estimating remaining useful life [RUL] (preventive maintenance, i.e. planning maintenance according to the available resources without monitoring the system G06Q10/06)}
- G06F 11/261: {by simulating additional hardware, e.g. fault simulation}
- G06F 21/55: Detecting local intrusion or implementing counter-measures
- G06N 5/04: Inference or reasoning models
- G06N 20/00: Machine learning
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- H04L 63/1433: {Vulnerability analysis}
- H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G05B: CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS (systems for controlling or regulating non-electric variables G05D; systems for regulating electric or magnetic variables G05F; control devices or systems insofar as characterised by mechanical features only G05G)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS

## Abstract

An integrated vehicle health management (IVHM) system to resolve equipment-fault related anomalies detected by cyber intrusion detection system (IDS). A benefit of the present system is that it can result in fewer alerts that need manual analysis. A combination of cyber and monitoring with integrated vehicle health management (IVHM) may be a high value differentiator. As a solution gets more mature through a learning loop, it may be customized for different customers in a cost effective manner, something that might be expensive to develop on their own for most original equipment manufacturers (OEMs). An IVHM symptom pattern recognition matrix may link a pattern of reported symptoms to known equipment failures. This matrix may be initialized from the vehicle design data but its entries may get updated by a learning loop that improves a correlation by incorporating results of investigations.

## Claims

### Claim 1

An integrated equipment fault and cyber attack detection arrangement comprising:
a hardware intrusion detection system (IDS) for sensing cyber attacks and equipment failures upon a vehicle;
a security operations center (SOC) connected to the hardware IDS for receiving cyber attacks and equipment failures; and
an integrated vehicle health management (IVHM) hardware module connected to the SOC to process the cyber attacks and equipment failures;
wherein the hardware IDS, SOC and IVHM hardware module are configured to operate as follows:
the cyber attacks and equipment failures are regarded as anomalies and reported by the hardware IDS to the SOC;
detected anomalies from the hardware IDS are passed on by the SOC to the IVHM hardware module for pattern recognition;
the IVHM hardware module analyzes the passed on anomalies to recognize patterns in the passed on anomalies and thereby segregate known equipment failures from unrecognized anomaly patterns;
the IVHM hardware module generates a recommended maintenance plan for recognized patterns in the anomalies associated with known equipment failures;
the IVHM hardware module sends any unrecognized anomaly patterns to the SOC for analysis;
the unrecognized anomaly patterns are investigated at the SOC and, if the unrecognized anomaly patterns are investigated resulting in a new equipment failure pattern, the IVHM hardware module is configured to receive the new equipment failure pattern and use the new equipment failure pattern to recognize future equipment failures.

### Claim 2 (depends on 1)

The arrangement of claim 1, wherein the detected anomalies include an abnormal frequency of events reported by the SOC to the IVHM hardware module.

### Claim 3

A method for intrusion detection comprising:
detecting cyber attacks and equipment failures upon a vehicle;
reporting the detected cyber attacks and equipment failures from the vehicle as anomalies to a security operations center (SOC) for a fleet of vehicles;
passing the anomalies from the SOC to an integrated vehicle health maintenance (IVHM) hardware module configured to identify patterns of anomalies associated with known equipment failures;
at the IVHM hardware module, determining whether any patterns of anomalies match known equipment failures, and, if so, removing such anomalies and generating maintenance plans for any such known equipment failures;
returning, from the IVHM hardware module to the SOC, any anomalies having unrecognized patterns;
investigating the anomalies having unrecognized patterns to identify either a cyber attack or a new equipment failure pattern; and
if a new equipment failure pattern is identified, sending information to the IVHM hardware module to add to a list of known equipment failures and associated anomaly patterns.

### Claim 4 (depends on 3)

The method of claim 3, wherein the unrecognized patterns are reviewed at the security operations center (SOC).

### Claim 5 (depends on 4)

The method of claim 4, wherein: the unrecognized patterns have issues that are analyzed or investigated by a human.

### Claim 6 (depends on 3)

The method of claim 3, wherein the IVHM hardware module comprises a table of known patterns relating to known equipment failures.