Back to results
US 11,457,035 B2Granted
Network intrusion detection system and methods with statistic profile based network interface controllers
AssigneeHarman Becker Automotive Systems GmbH
InventorGerd Zimmermann
Life of this patent
Estimating the term…
Abstract
The present disclosure relates to systems, devices and methods for detecting network intrusions. Embodiments are directed to processing vehicle network traffic with known traffic profiles. In one embodiment, violations of the known traffic profiles may be reported. Configurations and processes are also provided for network interface controllers.
Claims18
A method for detecting network intrusions, the method comprising:
- receiving, by a Network Interface Controller (NIC), a set of vehicle network traffic;
- comparing one or more indicators of the set of vehicle network traffic with one or more known traffic profiles;
- detecting a violation of the known traffic profiles based on the comparison and based on a transition from falling within a first allowed range of traffic-profile parameter values to falling within a second allowed range of traffic-profile parameter values, wherein the detecting includes an Open Systems Interconnection (OSI) layer 2 prevention;
- and
- reporting the violation of the known traffic profiles.
2 more elements
A method for using a Network Interface Controller (NIC) to detect network intrusions, the method comprising:
- receiving, by the NIC, a set of vehicle network traffic;
- storing one or more indicators of the set of vehicle network traffic;
- comparing the stored indicators of the set of vehicle network traffic with a known traffic profile;
- detecting a violation of the known traffic profile based on the comparison and based on a transition from falling within a first allowed range of traffic-profile parameter values to falling within a second allowed range of traffic-profile parameter values;
- and
- initiating an action in response to detecting the violation of the known traffic profile,
- wherein the detecting of the violation of the known traffic profile includes detecting that a timing relationship of the set of vehicle network traffic falls outside of a timing relationship of the known traffic profile.
4 more elements
A network intrusion detection system, comprising:
- an input operable to receive vehicle network traffic;
- a Network Interface Controller (NIC) coupled to the input;
- and
- a processor having executable instructions stored in a non-transitory memory that, when executed, cause the processor to:
- store one or more NIC hardware statistic parameters of the vehicle network traffic in one or more NIC hardware statistic registers;
- compare the NIC hardware statistic parameters of the vehicle network traffic with one or more known traffic profiles;
- detect a violation of the known traffic profiles based on the comparison and based on a transition from falling within a first allowed range of traffic-profile parameter values to falling within a second allowed range of traffic-profile parameter values;
- and
- initiate an action in response to detecting the violation of the known traffic profiles.
6 more elements
Dependencies are inferred from the claim text.