# US 12,001,553 B2 · Detecting vehicle malfunctions and cyber attacks using machine learning

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,001,553 B2
- Document ID: US12001553B2
- Status: Granted
- Kind: B2
- Application number: 17/404,759
- Filed: 2021-08-17
- Published: 2023-02-23
- Granted: 2024-06-04
- Earliest claimed: 2020-08-20
- Assignees: Red Bend Ltd.
- Applicants: Red Bend Ltd.
- Inventors: Dror Cohen; Alexander Kreines; Shachar Mendelowitz
- Web page: https://patentgrep.com/patent/US12001553B2

## CPC

- G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities}
- G06N 20/20: Ensemble learning
- B60W 50/0205: {Diagnosing or detecting failures; Failure detection models}
- G06F 21/554: {involving event detection and direct action}
- G06F 21/556: {involving covert channels, i.e. data leakage between processes (inhibiting the analysis of circuitry or operation with measures against power attack G06F21/755)}
- G06F 21/577: {Assessing vulnerabilities and evaluating computer system security}
- G06F 21/85: interconnection devices, e.g. bus-connected or in-line devices
- G06N 3/0442: characterised by memory or gating, e.g. long short-term memory [LSTM] or gated recurrent units [GRU]
- G06N 3/0455: Auto-encoder networks; Encoder-decoder networks
- G06N 3/0464: Convolutional networks [CNN, ConvNet]
- G06N 3/0475: Generative networks
- G06N 3/0895: Weakly supervised learning, e.g. semi-supervised or self-supervised learning
- G06N 3/09: Supervised learning
- G06N 3/094: Adversarial learning
- G06N 3/0985: Hyperparameter optimisation; Meta-learning; Learning-to-learn
- G07C 5/0808: {Diagnosing performance data (testing of vehicles G01M17/00; testing of electrical installation on vehicles G01R31/005)}
- B60W 2050/021: {Means for detecting failure or malfunction}
- G06F 2221/034: Test or assess a computer or a system
- G06N 3/045: Combinations of networks
- G06N 3/08: Learning methods
- G06N 5/01: Dynamic search techniques; Heuristics; Dynamic trees; Branch-and-bound
- G06N 7/01: Probabilistic graphical models, e.g. probabilistic networks
- H04L 67/12: specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- B60W: CONJOINT CONTROL OF VEHICLE SUB-UNITS OF DIFFERENT TYPE OR DIFFERENT FUNCTION; CONTROL SYSTEMS SPECIALLY ADAPTED FOR HYBRID VEHICLES; ROAD VEHICLE DRIVE CONTROL SYSTEMS FOR PURPOSES NOT RELATED TO THE CONTROL OF A PARTICULAR SUB-UNIT
- G07C: TIME OR ATTENDANCE REGISTERS; REGISTERING OR INDICATING THE WORKING OF MACHINES; GENERATING RANDOM NUMBERS; VOTING OR LOTTERY APPARATUS; ARRANGEMENTS, SYSTEMS OR APPARATUS FOR CHECKING NOT PROVIDED FOR ELSEWHERE
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Techniques for detecting anomalies or cyber attacks on a vehicle. A computer-implemented method for anomaly or attack detection includes determining, using a first model, a first predicted value of a first variable message associated with a vehicle, determining, using a second model, a second predicted value of the first variable message associated with the vehicle, determining, based on a difference between an actual value of the first variable message and the first predicted value of the first variable message and on a difference between the actual value of the first variable message and the second predicted value of the first variable message, a vector, and determining, using a third model, an output value based on the vector, the output value corresponding to at least one of a likelihood that an anomaly or an attack is occurring or a type of the anomaly or the attack.

## Claims

### Claim 1

A computer-implemented method for anomaly or attack detection, the method comprising:
determining, using a first model, a first predicted value of a first variable message associated with a vehicle;
determining, using a second model different from the first model, a second predicted value of the first variable message associated with the vehicle, wherein the first model and the second model are selected based on resilience to one or more types of cyber attacks;
determining, based on a difference between an actual value of the first variable message and the first predicted value of the first variable message and on a difference between the actual value of the first variable message and the second predicted value of the first variable message, a vector; and
determining, using a third model, an output value based on the vector, the output value corresponding to at least one of a likelihood that an anomaly or an attack is occurring or a type of the anomaly or the attack.

### Claim 2 (depends on 1)

The method of claim 1, wherein the first variable message comprises a continuous variable message associated with a first operational parameter of the vehicle.

### Claim 3 (depends on 2)

The method of claim 2, wherein the first predicted value of the first variable message comprises a predicted value of the first operational parameter.

### Claim 4 (depends on 1)

The method of claim 1, wherein the first variable message comprises a categorical variable message associated with a first operational parameter of the vehicle.

### Claim 5 (depends on 4)

The method of claim 4, wherein the first predicted value of the first variable message comprises a predicted probability associated with the first operational parameter.

### Claim 6 (depends on 1)

The method of claim 1, wherein the first model comprises a time series model.

### Claim 7 (depends on 1)

The method of claim 1, wherein the second model comprises a regression model.

### Claim 8 (depends on 1)

The method of claim 1, wherein the vector comprises a vector of errors or residuals.

### Claim 9 (depends on 1)

The method of claim 1, wherein the vector comprises a vector of probabilities.

### Claim 10 (depends on 1)

The method of claim 1, further comprising determining, using a fourth model, a third predicted value of a second variable message associated with the vehicle.

### Claim 11 (depends on 1)

The method of claim 1, further comprising:
determining, using a fourth model, a second output value based on the vector; and
combining the output value and the second output value, the combined output value corresponding to at least one of the likelihood that the anomaly or the attack is occurring or the type of the anomaly or the attack.

### Claim 12 (depends on 1)

The method of claim 1, wherein the third model comprises a meta model.

### Claim 13 (depends on 1)

The method of claim 1, further comprising determining, using the first model, a third predicted value of a second variable message associated with the vehicle.

### Claim 14 (depends on 1)

The method of claim 1, wherein determining, using the first model, the first predicted value of the first variable message associated with the vehicle comprises determining the first predicted value using at least one second variable messages associated with the vehicle, wherein the at least one second variable message is correlated with the first variable message.

### Claim 15

One or more non-transitory computer-readable storage media including instructions that, when executed by one or more processors, cause the one or more processors to perform the steps of:
determining, using a first model, a first predicted value of a first variable message associated with a vehicle;
determining, using a second model different from the first model, a second predicted value of the first variable message associated with the vehicle, wherein the first model and the second model are selected based on resilience to one or more types of cyber attacks;
determining, based on a difference between an actual value of the first variable message and the first predicted value of the first variable message and on a difference between the actual value of the first variable message and the second predicted value of the first variable message, a vector; and
determining, using a third model, an output value based on the vector, the output value corresponding to at least one of a likelihood that an anomaly or an attack is occurring or a type of the anomaly or the attack.

### Claim 16 (depends on 15)

The one or more non-transitory computer-readable storage media of claim 15, wherein the first model comprises a time series model, and the second model comprises a regression model.

### Claim 17 (depends on 15)

The one or more non-transitory computer-readable storage media of claim 15, wherein the first model comprises a first time series model, and the second model comprises a second time series model.

### Claim 18 (depends on 15)

The one or more non-transitory computer-readable storage media of claim 15, wherein the first model comprises a first regression model, and the second model comprises a second regression model.

### Claim 19

A system, comprising:
a memory storing an application; and
one or more processors that, when executing the application, is configured to:
determine, using a first model, a first predicted value of a first variable message associated with a vehicle;
determine, using a second model different from the first model, a second predicted value of a second variable message associated with the vehicle, wherein the first model and the second model are selected based on resilience to one or more types of cyber attacks;
determine, based on a difference between an actual value of the first variable message and the first predicted value of the first variable message and on a difference between an actual value of the second variable message and the second predicted value of the second variable message, a vector; and
determine, using a third model, an output value based on the vector, the output value corresponding to at least one of a likelihood that an anomaly or an attack is occurring or a type of the anomaly or the attack.

### Claim 20 (depends on 19)

The system of claim 19, wherein the one or more processors, when executing the application, is further configured to determine, using the first model, a third predicted value of a third variable message associated with the vehicle.