Trusted context self learning method for an in-vehicle network intrusion detection system developed to limit calibration proliferation and development costs

A system comprising:

• a processor configured to execute an in-vehicle Network Intrusion Detection System (NIDS) with an algorithm to monitor a set of Electronic Control Units (ECUs) and vehicle state elements by receiving a set of vehicle inputs about a vehicle's operating state;
• in response to a determination about the vehicle's operating state, the processor configured to identify a trusted context of allowability to learn about network topologies and whitelisted messages contained in a vehicle platform-specific build, wherein the trusted context is based on a trusted window that is identified based on a vehicle mileage and a security access status associated with manufacturing;
• the processor configured to create a vehicle-specific configuration containing a list of networks of topologies and whitelisted messages in use by the set of ECUs in the vehicle platform-specific build;
• and
• the processor configured to prevent misconfiguring of at least one network in the list of network topologies and whitelisted messages of the vehicle-specific configuration in the vehicle platform outside the trusted context window based on results from an assessment of at least one security implication of a network of a topology and whitelist message contained in a list in use by the set of ECUs in the vehicle platform-specific build.

A vehicle apparatus comprising:

• a vehicle controller comprising a processor wherein the processor implements an algorithm to determine a trusted window by an in-vehicle Network Intrusion Detection System (NIDS) to learn about a vehicle platform, comprising:
• execute the NIDS to monitor a set of Electronic Control Units (ECUs) and vehicle state elements by receipt of a set of vehicle inputs about a vehicle's operating state;
• in response to a determination about the vehicle's operating state, identify the trusted window during which to learn about a network topology and whitelisted messages contained in a vehicle platform is allowable, wherein the identifying is based on a vehicle mileage and a security access status associated with manufacturing;
• create a vehicle-specific configuration that contains a list of networks of topologies and whitelisted messages in use by the set of ECUs in the vehicle platform;
• and
• prevent misconfiguring of at least one network in the list of network topologies and whitelisted messages of the vehicle-specific configuration in the vehicle platform outside the trusted window based on results from an assessment of at least one security implication of a network of a topology and whitelist message contained in a list in use by the set of ECUs in the vehicle platform.