# US 11,999,364 B2 · Systems and methods for intrusion detection in vehicle systems

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,999,364 B2
- Document ID: US11999364B2
- Status: Granted
- Kind: B2
- Application number: 17/133,074
- Filed: 2020-12-23
- Published: 2021-04-22
- Granted: 2024-06-04
- Earliest claimed: 2020-12-23
- Assignees: Intel Corporation
- Applicants: Intel Corporation
- Inventors: Ignacio J. Alvarez; Maria Soledad Elli; Javier Felip Leon; Javier Sebastian Turek; David Israel Gonzalez Aguirre
- Web page: https://patentgrep.com/patent/US11999364B2

## CPC

- B60W 50/0205: {Diagnosing or detecting failures; Failure detection models}
- H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks}
- B60W 50/029: Adapting to failures or work around with other constraints, e.g. circumvention by avoiding use of failed parts
- B60W 50/038: Limiting the input power, torque or speed
- B60W 60/00188: {related to detected security violation of control systems, e.g. hacking of moving vehicle}
- B60W 60/0053: {from vehicle to occupant}
- G06N 3/006: based on simulated virtual individual or collective life forms, e.g. social simulations or particle swarm optimisation [PSO]
- G06N 3/047: Probabilistic or stochastic networks
- G06N 3/08: Learning methods
- G06N 7/01: Probabilistic graphical models, e.g. probabilistic networks
- H04L 63/1416: {Event detection, e.g. attack signature detection}
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- B60W 2050/0292: {Fail-safe or redundant systems, e.g. limp-home or backup systems}
- B60W 2050/046: {involving external transmission of data to or from the vehicle, e.g. via telemetry, satellite, Global Positioning System [GPS]}
- B60W: CONJOINT CONTROL OF VEHICLE SUB-UNITS OF DIFFERENT TYPE OR DIFFERENT FUNCTION; CONTROL SYSTEMS SPECIALLY ADAPTED FOR HYBRID VEHICLES; ROAD VEHICLE DRIVE CONTROL SYSTEMS FOR PURPOSES NOT RELATED TO THE CONTROL OF A PARTICULAR SUB-UNIT
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS

## Abstract

A vehicle control system (VCS) for a vehicle may include an in-vehicle bus and an intrusion detection system (IDS). The IDS may: calculate a planned output of the vehicle based on a message of a message stream received from at least one electronic control unit (ECU) coupled to the in-vehicle bus, calculate a reachable set based on an uncertainty metric, and identify an intrusion of the VCS based on a comparison of the planned output and the reachable set.

## Claims

### Claim 1

A vehicle control system (VCS) for a vehicle, the VCS comprising:
an in-vehicle bus; and
an intrusion detection system (IDS) configured to:
calculate a planned output of the vehicle based on a message of a message stream received from at least one electronic control unit (ECU) coupled to the in-vehicle bus;
calculate a reachable set based on an uncertainty metric; and
identify an intrusion of the VCS based on a comparison of the planned output and the reachable set.

### Claim 2 (depends on 1)

The VCS of claim 1, wherein the comparison of the planned output and the reachable set comprises determining if the planned output exceeds the reachable set.

### Claim 3 (depends on 1)

The VCS of claim 1, wherein the planned output includes one or more trajectories of the vehicle.

### Claim 4 (depends on 3)

The VCS of claim 3, wherein the IDS is configured to identify the intrusion if the one or more trajectories extends outside of the reachable set.

### Claim 5 (depends on 1)

The VCS of claim 1, wherein the IDS is further configured to determine a source of the intrusion in response to identifying the intrusion.

### Claim 6 (depends on 1)

The VCS of claim 1, wherein the IDS is further configured to determine a criticality of the intrusion in response to identifying the intrusion.

### Claim 7 (depends on 6)

The VCS of claim 6, wherein the criticality of the intrusion is determined based on a safety model.

### Claim 8 (depends on 1)

The VCS of claim 1, wherein the IDS is further configured to filter out one or more perception values or one or more actuation values from the message stream.

### Claim 9 (depends on 1)

The VCS of claim 1, wherein the IDS is further configured to, based on a determined criticality of the intrusion:
control the VCS to perform an emergency maneuver; or
cause a handover of control of the vehicle to a driver.

### Claim 10 (depends on 9)

The VCS of claim 9, wherein the IDS is further configured to determine the criticality of the intrusion based on a safety model.

### Claim 11 (depends on 1)

The VCS of claim 1, wherein the message is perception data from at least one of the one more ECUs.

### Claim 12 (depends on 1)

The VCS of claim 1, wherein the uncertainty metric is a-priori uncertainty information corresponding to one or more of the at least one ECUs.

### Claim 13 (depends on 1)

The VCS of claim 1, wherein the IDS is implemented in another ECU coupled to the in-vehicle bus.

### Claim 14 (depends on 1)

The VCS of claim 1, further comprising a plurality of ECUs, wherein the IDS is implemented in a distributed configuration in at least two of the plurality of ECUs.

### Claim 15

At least one non-transitory computer-readable medium including a set of instructions that, in response to being executed at an electronic control unit (ECU) among a plurality of ECUs connected to an in-vehicle bus of a vehicle control system (VCS), cause the respective ECU to:
calculate a planned output of a vehicle based on a message of a message stream received from at least one of the plurality of ECU via the in-vehicle bus;
calculate a reachable set based on an uncertainty metric; and
identify an intrusion of the VCS based on a comparison of the planned output and the reachable set.

### Claim 16 (depends on 15)

The medium of claim 15, wherein the comparison of the planned output and the reachable set comprises determining if the planned output exceeds the reachable set.

### Claim 17 (depends on 15)

The medium of claim 15, wherein the planned output includes one or more trajectories of the vehicle.

### Claim 18 (depends on 17)

The medium of claim 17, wherein the intrusion is identified if the one or more trajectories extends outside of the reachable set.

### Claim 19 (depends on 15)

The medium of claim 15, further comprising determining a source of the intrusion in response to identifying the intrusion.

### Claim 20 (depends on 15)

The medium of claim 15, further comprising determining a criticality of the intrusion in response to identifying the intrusion.

### Claim 21 (depends on 15)

The medium of claim 15, wherein the uncertainty metric is a-priori uncertainty information corresponding to one or more of the at least one ECUs.

### Claim 22

An intrusion detection method of a control system of a vehicle, the method comprising:
calculating a planned output of the vehicle based on a message of a message stream received from at least one electronic control unit (ECU) coupled to an in-vehicle bus;
calculating a reachable set based on an uncertainty metric; and
comparing the planned output and the reachable set to identify an intrusion of the control system.

### Claim 23 (depends on 22)

The method of claim 22, wherein the comparison of the planned output and the reachable set comprises determining if the planned output exceeds the reachable set.

### Claim 24 (depends on 22)

The method of claim 22, wherein the planned output includes one or more trajectories of the vehicle, the intrusion being identified if the one or more trajectories extends outside of the reachable set.