# US 11,444,961 B2 · Active attack detection in autonomous vehicle networks

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,444,961 B2
- Document ID: US11444961B2
- Status: Granted
- Kind: B2
- Application number: 16/723,142
- Filed: 2019-12-20
- Published: 2020-04-23
- Granted: 2022-09-13
- Earliest claimed: 2019-12-20
- Assignees: Intel Corporation
- Applicants: Intel Corporation
- Inventors: Marcio Juliato; Vuk Lesi; Shabbir Ahmed; Christopher Gutierrez; Manoj Sastry; Liuyang Yang; Xiruo Liu
- Web page: https://patentgrep.com/patent/US11444961B2

## CPC

- G05B 19/0421: {Multiprocessor system}
- H04L 63/1416: {Event detection, e.g. attack signature detection}
- G05B 19/042: using digital processors (G05B19/05 takes precedence)
- G05D 1/0088: {characterized by the autonomous decision making process, e.g. artificial intelligence, predefined behaviours (using knowledge based models G06N5/00)}
- G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities}
- G06F 21/567: {using dedicated hardware}
- H04L 12/4035: {in which slots of a TDMA packet structure are assigned based on a contention resolution carried out at a master unit (TDM/TDMA multiplex systems per se H04J3/1694; hybrid switching systems H04L12/64)}
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- H04W 12/121: Wireless intrusion detection systems [WIDS]; Wireless intrusion prevention systems [WIPS]
- H04W 12/61: Time-dependent
- G05B 2219/25257: Microcontroller
- G05B 2219/2637: Vehicle, car, auto, wheelchair
- G06F 21/564: {by virus signature recognition}
- H04L 63/1458: {Denial of Service}
- H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks}
- H04L 2012/40215: {Controller Area Network CAN}
- H04L 2209/84: Vehicles
- H04W 12/122: Counter-measures against attacks; Protection against rogue devices
- G05B: CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS (systems for controlling or regulating non-electric variables G05D; systems for regulating electric or magnetic variables G05F; control devices or systems insofar as characterised by mechanical features only G05G)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G05D: SYSTEMS FOR CONTROLLING OR REGULATING NON-ELECTRIC VARIABLES
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

Systems, methods, computer-readable storage media, and apparatuses to provide active attack detection in autonomous vehicle networks. An apparatus may comprise a plurality of electronic control units communicably coupled by a network, and logic, at least a portion of which is implemented in hardware, the logic to: receive an indication from a first electronic control unit (ECU) of the plurality of ECUs specifying to transmit a first data frame via the network, determine, based on a message identifier (ID) of the first ECU, whether a transmit window for the first ECU is open, and permit the first ECU to transmit the first data frame via the network based on a determination that the transmit window for the first ECU is open.

## Claims

### Claim 1

An autonomous vehicle, comprising:
a plurality of electronic control units communicably coupled by a network; and
logic, at least a portion of which is implemented in hardware, the logic to:
receive an indication from a first electronic control unit (ECU) of the plurality of ECUs specifying to transmit a first data frame via the network;
determine, based on a message identifier (ID) of the first ECU, whether a transmit window for the first ECU is open;
permit the first ECU to transmit the first data frame via the network based on a determination that the transmit window for the first ECU is open;
determine whether the first ECU is subject to a flooding attack when the first ECU transmits the first data frame during the transmit window;
determine whether the first ECU is subject to a suspension attack when the first ECU does not transmit the first data frame during the transmit window; and
generate an alert in response to a flooding attack or a suspension attack.

### Claim 2 (depends on 1)

The autonomous vehicle of claim 1, the logic further configured to:
determine whether a second ECU of the plurality of ECUs is to transmit a data frame via the network during the transmit window for the first ECU;
determine that the first ECU is subject to the flooding attack when the second ECU is to not transmit the data frame via the network during the transmit window of the first ECU; or
determine that the first ECU is not subject to the flooding attack when the second ECU is to transmit the data frame via the network during the transmit window of the first ECU, and the logic further configured to:
delay the transmission of the first data frame by the first ECU; and
permit the first ECU to transmit the first data frame subsequent to the second ECU transmitting the data frame and during the transmit window for the first ECU, at least a portion of the transmit window included in a transmit interval to transmit data via the network.

### Claim 3 (depends on 2)

The autonomous vehicle of claim 2, the logic further configured to:
receive, during the transmit interval, a second indication from the first ECU specifying to transmit a second data frame via the network during a second transmit window, at least a portion of the second transmit window included in the transmit interval; and
permit the first ECU to transmit the second data frame during the portion of the second transmit window included in the transmit interval based on the determination that the second ECU transmitted data via the network during the transmit window for the first ECU.

### Claim 4 (depends on 1)

The autonomous vehicle of claim 1, the logic further configured to:
determine, based on the message ID of the first ECU, that a transmit interval for the first ECU has expired;
determine that the first ECU did not transmit data during the transmit interval;
determine that the first ECU is subject to the suspension attack; and
generate the alert specifying that the first ECU is subject to the suspension attack.

### Claim 5 (depends on 1)

The autonomous vehicle of claim 1, the logic further configured to:
determine a voltage fingerprint of the first data frame;
determine that the voltage fingerprint is not equal to a known voltage feature of the first ECU; and
modify, based on the determination that the voltage fingerprint is not equal to the known voltage feature of the first ECU, at least a portion of the first data frame.

### Claim 6 (depends on 5)

The autonomous vehicle of claim 5, wherein one or more of a cyclic redundancy check portion of the first data frame or a payload of the first data frame are to be modified to cause the other ECUs to reject the first data frame, wherein the network comprises a controller area network (CAN).

### Claim 7 (depends on 1)

The autonomous vehicle of claim 1, further comprising a standby ECU of the plurality of ECUs configured to:
analyze a first portion of a payload of the first data frame;
determine that the first portion of the payload specifies to modify an operational parameter of the autonomous vehicle to a specified value;
determine, based on a current state of the autonomous vehicle, that the specified value is outside a range of expected values for the operational parameter; and
modify a second portion of the payload of the first data frame to cause the other ECUs to refrain from causing the operational parameter of the autonomous vehicle to have the specified value.

### Claim 8 (depends on 7)

The autonomous vehicle of claim 7, the standby ECU further configured to:
restricting the first ECU from operating in the autonomous vehicle; and
operate as the first ECU in the autonomous vehicle.

### Claim 9

An apparatus, comprising:
a plurality of electronic control units of an autonomous vehicle communicably coupled by a network; and
logic, at least a portion of which is implemented in hardware, the logic to:
receive an indication from a first electronic control unit (ECU) of the plurality of ECUs specifying to transmit a first data frame via the network;
determine, based on a message identifier (ID) of the first ECU, whether a transmit window for the first ECU is open;
permit the first ECU to transmit the first data frame via the network based on a determination that the transmit window for the first ECU is open;
determine whether the first ECU is subject to a flooding attack when the first ECU transmits the first data frame during the transmit window;
determine whether the first ECU is subject to a suspension attack when the first ECU does not transmit the first data frame during the transmit window; and
generate an alert in response to a flooding attack or a suspension attack.

### Claim 10 (depends on 9)

The apparatus of claim 9, the logic further configured to:
determine whether a second ECU of the plurality of ECUs is to transmit a data frame via the network during the transmit window for the first ECU;
determine that the first ECU is subject to the flooding attack when the second ECU is to not transmit the data frame via the network during the transmit window of the first ECU; or
determine that the first ECU is not subject to the flooding attack when the second ECU is to transmit the data frame via the network during the transmit window of the first ECU, and the logic further configured to:
delay the transmission of the first data frame by the first ECU; and
permit the first ECU to transmit the first data frame subsequent to the second ECU transmitting the data frame and during the transmit window for the first ECU, at least a portion of the transmit window included in a transmit interval to transmit data via the network.

### Claim 11 (depends on 10)

The apparatus of claim 10, the logic further configured to:
receive, during the transmit interval, a second indication from the first ECU specifying to transmit a second data frame via the network during a second transmit window, at least a portion of the second transmit window included in the transmit interval; and
permit the first ECU to transmit the second data frame during the portion of the second transmit window included in the transmit interval based on the determination that the second ECU transmitted data via the network during the transmit window for the first ECU.

### Claim 12 (depends on 9)

The apparatus of claim 9, the logic further configured to:
determine, based on the message ID of the first ECU, that a transmit interval for the first ECU has expired;
determine that the first ECU did not transmit data during the transmit interval;
determine that the first ECU is subject to the suspension attack; and
generate the alert specifying that the first ECU is subject to the suspension attack.

### Claim 13 (depends on 9)

The apparatus of claim 9, the logic further configured to:
determine a voltage fingerprint of the first data frame;
determine that the voltage fingerprint is not equal to a voltage feature of the first ECU; and
modify, based on the determination that the voltage fingerprint is not equal to the voltage feature of the first ECU, at least a portion of the first data frame.

### Claim 14 (depends on 13)

The apparatus of claim 13, wherein one or more of a cyclic redundancy check portion of the first data frame or a payload of the first data frame are to be modified to cause the other ECUs to reject the first data frame, wherein the network comprises a controller area network (CAN).

### Claim 15 (depends on 9)

The apparatus of claim 9, further comprising a standby ECU of the plurality of ECUs configured to:
analyze a first portion of a payload of the first data frame;
determine that the first portion of the payload specifies to modify an operational parameter of the autonomous vehicle to a specified value;
determine, based on a current state of the autonomous vehicle, that the specified value is outside a range of expected values for the operational parameter; and
modify a second portion of the payload of the first data frame to cause the other ECUs to refrain from causing the operational parameter of the autonomous vehicle to have the specified value.

### Claim 16

A method, comprising:
receiving, by logic implemented at least partially in hardware, an indication from a first electronic control unit (ECU) of a plurality of ECUs specifying to transmit a first data frame via a network of an autonomous vehicle;
determining, by the logic based on a message identifier (ID) of the first ECU, whether a transmit window for the first ECU is open;
permitting, by the logic, the first ECU to transmit the first data frame via the network based on a determination that the transmit window for the first ECU is open;
determining, by the logic, whether the first ECU is subject to a flooding attack when the first ECU transmits the first data frame during the transmit window;
determining, by the logic, whether the first ECU is subject to a suspension attack when the first ECU does not transmit the first data frame during the transmit window; and
generating, by the logic, an alert in response to a flooding attack or a suspension attack.

### Claim 17 (depends on 16)

The method of claim 16, wherein the network comprises a controller area network (CAN) network, the method further comprising:
determining, by the logic, whether a second ECU of the plurality of ECUs is to transmit a data frame via the network during the transmit window for the first ECU;
determining, by the logic, that the first ECU is subject to the flooding attack when the second ECU is to not transmit the data frame via the network during the transmit window of the first ECU; or
determining, by the logic, that the first ECU is not subject to the flooding attack when the second ECU is to transmit the data frame via the network during the transmit window of the first ECU, and the logic further configured to:
delaying, by the logic, the transmission of the first data frame by the first ECU; and
permitting, by the logic, the first ECU to transmit the first data frame subsequent to the second ECU transmitting the data frame and during the transmit window for the first ECU, at least a portion of the transmit window included in a transmit interval to transmit data via the network.

### Claim 18 (depends on 17)

The method of claim 17, further comprising:
receiving, by the logic during the transmit interval, a second indication from the first ECU specifying to transmit a second data frame via the network during a second transmit window, at least a portion of the second transmit window included in the transmit interval; and
permitting, by the logic, the first ECU to transmit the second data frame during the portion of the second transmit window included in the transmit interval based on the determination that the second ECU transmitted data via the network during the transmit window for the first ECU.

### Claim 19 (depends on 16)

The method of claim 16, further comprising:
determining, by the logic based on the message ID of the first ECU, that a second transmit interval for the first ECU has expired;
determining, by the logic, that the first ECU did not transmit data during the second transmit interval;
determining, by the logic, that the first ECU is subject to the suspension attack; and
generating, by the logic, the alert specifying that the first ECU is subject to the suspension attack.

### Claim 20 (depends on 19)

The method of claim 19, further comprising:
determining, by the logic, a voltage fingerprint of the first data frame;
determining, by the logic, that the voltage fingerprint is not equal to a voltage feature of the first ECU; and
modifying, by the logic based on the determination that the voltage fingerprint is not equal to the voltage feature of the first ECU, at least a portion of the first data frame, the at least the portion of the first data frame comprising a cyclic redundancy check portion of the first data frame or a payload of the first data frame.

### Claim 21 (depends on 16)

The method of claim 16, further comprising:
analyzing, by the logic, a first portion of a payload of the first data frame;
determining, by the logic, that the first portion of the payload specifies to modify an operational parameter of the autonomous vehicle to a specified value;
determining, by the logic based on a current state of the autonomous vehicle, that the specified value is outside a range of expected values for the operational parameter; and
modifying, by the logic, a second portion of the payload of the first data frame to cause the other ECUs to refrain from causing the operational parameter of the autonomous vehicle to have the specified value.

### Claim 22 (depends on 16)

The method of claim 16, further comprising:
restricting the first ECU from operating in the autonomous vehicle; and
causing a standby ECU of the plurality of ECUs to operate as the first ECU in the autonomous vehicle.