Method and apparatus for controller area network bus intrusion detection and neutralization

A Method for bus intrusion detection and neutralization for a vehicle comprising a vehicle network bus and electronic control units coupled to the vehicle network bus, the method comprising:

• providing the vehicle with a predetermined electronic control unit, the predetermined electronic control unit comprising:
• a processor;
• a memory;
• and an interface to the vehicle network bus;
• operating the electronic control unit to monitor messages on the vehicle network bus;
• monitoring a unique bit timing characteristics of each incoming message to establish trusted bit timing characteristics for a message and changing a trusted flag from a default of FALSE to TRUE;
• comparing the bit timing characteristics of the most recent message to the trusted bit timing characteristics for a message identifier against a predetermined threshold limit and increasing a detection counter by 1 if not within the threshold limit, and reducing the detection counter by 1 if within the threshold limit;
• setting an intrusion detection flag to TRUE if the detection counter reaches the threshold limit;
• and
• generating an alert upon detection of one or more intrusions.

A system for intrusion detection and neutralization for a vehicle on a vehicle network bus comprising:

• a predetermined electronic control unit, the predetermined electronic control unit comprising:
• a processor;
• a memory;
• and an interface to the vehicle network bus based on a network standard;
• the electronic control unit monitors messages on the bus for the unique bit timing characteristics of each incoming message to establish trusted bit timing characteristics for the message and changes a trusted flag in the memory from a default of FALSE to TRUE;
• a detection counter that increases by 1 if the most recent message does not meet a pre-determined threshold limit and reduces by 1 if a message identifier is within the pre-determined threshold limit;
• the detection counter sets a detection flag to TRUE if the detection counter reaches the threshold limit;
• and
• the electronic control unit generates an alert upon detection of one or more intrusions based on a status of the detection flag.