Detecting abnormal CAN bus wake-up pattern
AssigneeFord Global Technologies, LLC
InventorsYu Seung Kim, Byungho Cha
Life of this patent
Estimating the term…
Abstract
Techniques for using a detector coupled to a controller area network (CAN) bus of a vehicle system to identify and generate alerts in response to wake-up attacks on the vehicle system. Techniques include an electronic control unit (ECU) sending a wake-up message across the CAN bus that is detected by the detector. The detector includes memory and a processor to identify the timestamp of the wake-up message when the vehicle ignition is off. The detector determines a total operational time for the ECU over an observation time period and generates a notification of a wake-up anomaly when the total operational time over the observation time period exceeds a predetermined threshold.
Claims20
A vehicle system, comprising:
- a controller area network (CAN) bus;
- an electronic control unit (ECU) communicatively coupled to the CAN bus;
- and
- a detector communicatively coupled to the CAN bus, the detector comprising:
- a non-volatile memory;
- a CAN transceiver;
- a CAN controller;
- and
- a microcontroller comprising a memory having stored thereon instructions that, upon execution by one or more processors of the microcontroller, cause the one or more processors to:
- receive a message from the ECU communicated across the CAN bus at a first time;
- store, in the non-volatile memory, a wake-up time corresponding to the first time;
- determine a total operation time for the ECU over an observation time period by summing all operational time over the observation time period;
- and
- generate a wake-up anomaly notification based on a determination that a percentage of the total operation time over the observation time period exceeds a predetermined threshold.
A computer-implemented method, comprising:
- receiving, at a detector communicatively coupled to a controller area network (CAN) bus, a message from an electronic control unit (ECU) of a vehicle system communicated across the CAN bus of the vehicle system at a first time;
- storing, in a non-volatile memory of the detector, a wake-up time corresponding to the first time;
- determining a total operation time for the ECU over an observation time period by summing all operational time over the observation time period;
- and
- generating a wake-up anomaly notification based on a determination that a percentage of the total operation time over the observation time period exceeds a predetermined threshold.
Dependencies are inferred from the claim text.