Method for handling an anomaly of data, in particular in a motor vehicle
AssigneeRobert Bosch GmbH
InventorsManuel Jauss, Roland Steffen, Mustafa Kartal
Life of this patent
Estimating the term…
Abstract
A method for handling an anomaly of data, in particular in a motor vehicle. At least one sensor obtains data for the anomaly detection. The sensor examines the obtained data for anomalies, and generates an event as a function of the associated data when an anomaly is detected. It is decided whether the event is further processed, in particular stored and/or further communicated, at least in part.
Claims16
A method of a communications system that includes a gateway that includes ports for interfacing with a plurality of electronic communication sources and that is communicatively coupled with an intrusion detection system (IDS) device, the IDS device being configured to control communications operations of the gateway in response to detected cyber attacks at the gateway that are indicated by the gateway to the IDS device in response to detection by the gateway of anomalous data of a plurality of data incoming at the ports, the method comprising the following steps:
- obtaining, by at least one sensor of the gateway, the data incoming at the ports;
- examining, by the sensor, the obtained data to determine whether any of the obtained data includes anomalies;
- generating, by the sensor, respective events as a function of instances of the obtained data for which the sensor detects respective anomalies;
- and randomly selecting, by the sensor, which of the events are further processed by the gateway for reporting of the respective instances to the IDS device, resulting in selected ones of the events and non-selected ones of the events, wherein none of the non-selected ones of the events are reported to the IDS device, the IDS device performing the communications operations control based on the selected ones of the events.
A method of a communications system that includes a gateway that includes ports for interfacing with a plurality of electronic communication sources and that is communicatively coupled with an intrusion detection system (IDS) device for the gateway to indicate to the IDS device detected cyber attacks at the gateway in response to detection by the gateway of anomalous data of a plurality of data incoming at the ports, the method comprising the following steps:
- obtaining, by at least one sensor of the gateway, the data incoming at the ports;
- examining, by the sensor, the obtained data to determine whether any of the obtained data includes anomalies;
- generating, by the sensor, respective events as a function of instances of the obtained data for which the sensor detects respective anomalies;
- and randomly selecting, by the sensor and from a memory of the gateway, which of the events are further processed by the gateway for reporting of the respective instances to the IDS device, which is configured to control communications operations of the gateway in response to the detected cyber attacks at the gateway that are indicated by the gateway to the IDS device;
- wherein:
- the memory includes at least two memory areas;
- a different respective number or offset of the events is assigned to each one of the at least two memory areas than each of the other ones of the at least two memory areas, the random selection of the events being made from the at least two memory areas;
- and the random selection is made by selecting a random number of the generated events or by selecting from a random offset of the generated events.
A method of a communications system that includes a gateway that includes ports for interfacing with a plurality of electronic communication sources and that is communicatively coupled with an intrusion detection system (IDS) device for the gateway to indicate to the IDS device detected cyber attacks at the gateway in response to detection by the gateway of anomalous data of a plurality of data incoming at the ports, the method comprising the following steps:
- obtaining, by at least one sensor of the gateway, the data incoming at the ports;
- examining, by the sensor, the obtained data to determine whether any of the obtained data includes anomalies;
- generating, by the sensor, respective events as a function of instances of the obtained data for which the sensor detects respective anomalies;
- and randomly selecting, by the sensor and using a random number, which of the events are further processed by the gateway for reporting of the respective instances to the IDS device, which is configured to control communications operations of the gateway in response to the detected cyber attacks at the gateway that are indicated by the gateway to the IDS device, wherein the random number is newly generated cyclically and/or as a function of certain system events.
A method of a communications system that includes a plurality of gateways (a) that each includes ports for interfacing with a plurality of electronic communication sources and (b) that are communicatively coupled with an intrusion detection system (IDS) device, the IDS device being configured to control communications operations of the gateways in response to detected cyber attacks at the gateways that are indicated by the gateways to the IDS device in response to detection by the gateways of anomalous data of a plurality of data incoming at the ports, the method comprising the following steps:
- each of the gateways:
- obtaining, by at least one sensor of the respective gateway, data incoming at the ports;
- examining, by the sensor of the respective gateway, the obtained data to determine whether any of the obtained data includes anomalies;
- generating, by the sensor of the respective gateway, respective events as a function of instances of the obtained data for which the sensor detects respective anomalies;
- randomly selecting, by the sensor of the respective gateway, which events are further processed by the gateway for reporting of the respective instances to the IDS device, resulting in selected ones of the events and non-selected ones of the events, wherein none of the non-selected ones of the events are reported to the IDS device;
- and for each respective one of the randomly selected ones of the events, generating, by the respective gateway, a respective report of the respective event, the report including a subset of the anomalous data of the randomly selected one of the events;
- and for each of one or more of the randomly selected ones of the events, reconstructing, by the IDS device, a larger portion of the anomalous data of the respective event than has been included in the respective reports based on a combination of the reports received by the IDS device from more than one of the gateways;
- and performing, by the IDS device, the communications operations control based on the reconstruction.
Dependencies are inferred from the claim text.