Systems and methods for embedded anomalies detector for cyber-physical systems

A system for detecting data anomalies on a device in communication with an embedded computing platform, the system comprising:

• a memory of the computing platform storing instructions;
• and
• a processor of the computing platform executing the instructions to perform a process, the process including:
• determining data patterns for data input to the device, data output from the device, and/or data stored in a memory of the device, wherein the data patterns comprise:
• a first data pattern delineating a set of boundaries for normal behavioral operation and a second data pattern comprising one or more pre-defined activity sequences associated with a known attack form, and wherein the device actuates a functionality of a vehicle component;
• monitoring the data input, the data output, and the data stored in the memory of the device at least based on the determined data patterns in parallel with processing of the data input, the data output, and/or the data stored in the memory of the device, by monitoring command messages transmitted to the device for controlling how the functionality of the component is actuated by the device;
• detecting, based on the monitoring, whether an anomaly exists in the data input, the data output, and/or the data stored in the memory of the device based on the monitoring, wherein the detecting comprises determining whether detected behavior of the command messages provided to the device falls outside the set of boundaries and/or whether detected sequences of an activity occurring on the device correspond to the one or more pre-defined activity sequences;
• recording, responsive to detecting that the anomaly exists in the data input, the data output, and/or the data stored in the memory, details associated with the anomaly in a database of the embedded computing platform;
• and
• selectively transmitting, in an alert notification, the details associated with the anomaly to a security service based on the command messages associated with the anomaly.

A non-transitory computer-readable medium,

• the non-transitory computer-readable medium storing instructions that, when executed by a processor of a computing platform embedded on a device, cause the processor to perform a method for detecting data anomalies on the device, the method comprising:
• determining data patterns for data input to the device, data output from the device, and/or data stored in a memory of the device, wherein the data patterns comprise:
• a first data pattern delineating a set of boundaries for normal behavioral operation and a second data pattern comprising one or more pre-defined activity sequences associated with a known attack form, and wherein the device actuates a functionality of a vehicle component;
• monitoring the data input, the data output, and the data stored in the memory of the device at least based on the determined data patterns in parallel with processing of the data input, the data output, and/or the data stored in the memory of the device, by monitoring command messages transmitted to the device for controlling how the functionality of the component is actuated by the device;
• detecting, based on the monitoring, whether an anomaly exists in the data input, the data output, and/or the data stored in the memory of the device based on the monitoring, wherein the detecting comprises determining whether detected behavior of the command messages provided to the device falls outside the set of boundaries and/or whether detected sequences of an activity occurring on the device correspond to the one or more pre-defined activity sequences;
• recording, responsive to detecting that the anomaly exists in the data input, the data output, and/or the data stored in the memory, details associated with the anomaly in a database of the embedded computing platform;
• and
• selectively transmitting, in an alert notification, the details associated with the anomaly to a security service based on the command messages associated with the anomaly.