# US 2021/0279331 A1 · Systems and methods for disabling a malicious ecu in a controller area network (can) bus > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0279331 A1 - Document ID: US20210279331A1 - Status: Published application - Kind: A1 - Application number: 17/329,618 - Filed: 2021-05-25 - Published: 2021-09-09 - Earliest claimed: 2020-02-14 - Assignees: Red Bend Ltd. - Applicants: Red Bend Ltd. - Inventors: Tomer Gilad; Shachar Rosen - Web page: https://patentgrep.com/patent/US20210279331A1 ## CPC - G06F 21/55: Detecting local intrusion or implementing counter-measures - G06F 21/554: {involving event detection and direct action} - G06F 21/556: {involving covert channels, i.e. data leakage between processes (inhibiting the analysis of circuitry or operation with measures against power attack G06F21/755)} - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04W 12/122: Counter-measures against attacks; Protection against rogue devices - G06F 2221/034: Test or assess a computer or a system - H04L 67/12: specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks - H04L 2012/40215: {Controller Area Network CAN} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract There is provided a computer implemented method of disabling a malicious electronic control unit (ECU) of a plurality of ECUs in communication with a controller area network (CAN) bus network, the method executed by a computing device in communication with the plurality of ECUs and the CAN bus network, the method comprising: detecting a malicious message transmitted by the malicious ECU over the CAN bus network, and injecting a plurality of bits over the CAN bus network to trigger a predefined plurality of errors for disabling the malicious ECU before the malicious ECU makes an additional attempt to retransmit an additional instance of the malicious message. ## Claims ### Claim 1 A system for disabling a malicious electronic control unit (ECU) of a plurality of ECUs in communication with a controller area network (CAN) bus network, comprising: a non-transitory memory having stored thereon a code for execution by at least one hardware processor of a computing device in communication with the plurality of ECUs and the CAN bus network, the code comprising: code instructions for detecting a malicious message transmitted by the malicious ECU over the CAN bus network; and code instructions for injecting a plurality of bits over the CAN bus network to trigger a predefined plurality of errors for disabling the malicious ECU before the malicious ECU makes an additional attempt to retransmit an additional instance of the malicious message, wherein the predefined number of the plurality of errors are triggered by a plurality of injection sessions, wherein each bit injection session is triggered in response to detection of an additional error, and wherein a first injection session of the plurality of injection sessions comprises injecting bits to trigger a first error and transmission of a first error flag, wherein a current error count value stored by at least one error counter of the malicious ECU is increased by the transmission of the first error flag; the code further comprising: code instructions for interrupting the error frame storing the first error flag and injecting bits as an additional bit injection session for manipulating the form of the error frame to trigger a form error, wherein the form error triggers transmission of another error flag which triggers another increase of the current error count value stored by the at least one error counter of the malicious ECU; code instructions for iterating the interrupting of an additional error frame and the injection of bits as an additional bit injection session for manipulating the form of the error frame, to trigger at each iteration the transmission of a form error form and a respective increase of the current error count value, wherein the number of iterations are performed accordingly to generate the predefined number of the plurality of errors for disabling the malicious ECU. ### Claim 2 (depends on 1) The system of claim 1, wherein a current error count value stored by at least one error counter of the malicious ECU is increased above an error threshold denoting disabling of the malicious ECU in response to the triggered predefined plurality of errors. ### Claim 3 (depends on 2) The system of claim 2, wherein a difference between the current error count value and the error threshold is greater than the value by which the error counter increases the current error count value in response to a single generated error. ### Claim 4 (depends on 2) The system of claim 2, wherein the predefined number of the plurality of errors is computed according to the error threshold value divided by amount of increase of the current error count value in response to generating a single error. ### Claim 5 (depends on 2) The system of claim 2, wherein the predefined number of the plurality of errors is 32 when the error threshold value is 255 and when the current transmit error count value is increased by 8 in response to generating a single error. ### Claim 6 (depends on 1) The system of claim 1, wherein the injected bits are designed to trigger one or more of the following errors, selected from the group consisting of: bit stuffing, bit error, cyclic redundancy check (CRC), monitoring, frame, and acknowledgement errors. ### Claim 7 (depends on 1) The system of claim 1, wherein manipulating the form of the error frame comprises transmitting a single dominant bit in place of the expected at least one recessive bit of an error delimiter field of the error frame. ### Claim 8 (depends on 1) The system of claim 1, wherein the last iteration of the interrupting the error frame is performed without the manipulating the form of the error frame. ### Claim 9 A computer program product for disabling a malicious electronic control unit (ECU) of a plurality of ECUs in communication with a controller area network (CAN) bus network, comprising: a non-transitory memory having stored thereon a code for execution by at least one hardware processor of a computing device in communication with the plurality of ECUs and the CAN bus network, the code comprising: instructions for detecting a malicious message transmitted by the malicious ECU over the CAN bus network; and instructions for injecting a plurality of bits over the CAN bus network to trigger a predefined plurality of errors for disabling the malicious ECU before the malicious ECU makes an additional attempt to retransmit an additional instance of the malicious message, wherein the predefined number of the plurality of errors are triggered by a plurality of injection sessions, wherein each bit injection session is triggered in response to detection of an additional error, and wherein a first injection session of the plurality of injection sessions comprises injecting bits to trigger a first error and transmission of a first error flag, wherein a current error count value stored by at least one error counter of the malicious ECU is increased by the transmission of the first error flag; the code further comprising: instructions for interrupting the error frame storing the first error flag and injecting bits as an additional bit injection session for manipulating the form of the error frame to trigger a form error, wherein the form error triggers transmission of another error flag which triggers another increase of the current error count value stored by the at least one error counter of the malicious ECU; instructions for iterating the interrupting of an additional error frame and the injection of bits as an additional bit injection session for manipulating the form of the error frame, to trigger at each iteration the transmission of a form error form and a respective increase of the current error count value, wherein the number of iterations are performed accordingly to generate the predefined number of the plurality of errors for disabling the malicious ECU. ### Claim 10 (depends on 9) The computer program product of claim 9, wherein a current error count value stored by at least one error counter of the malicious ECU is increased above an error threshold denoting disabling of the malicious ECU in response to the triggered predefined plurality of errors. ### Claim 11 (depends on 10) The computer program product of claim 10, wherein a difference between the current error count value and the error threshold is greater than the value by which the error counter increases the current error count value in response to a single generated error. ### Claim 12 (depends on 10) The computer program product of claim 10, wherein the predefined number of the plurality of errors is computed according to the error threshold value divided by amount of increase of the current error count value in response to generating a single error. ### Claim 13 (depends on 10) The computer program product of claim 10, wherein the predefined number of the plurality of errors is 32 when the error threshold value is 255 and when the current transmit error count value is increased by 8 in response to generating a single error. ### Claim 14 (depends on 9) The computer program product of claim 9, wherein the injected bits are designed to trigger one or more of the following errors, selected from the group consisting of: bit stuffing, bit error, cyclic redundancy check (CRC), monitoring, frame, and acknowledgement errors. ### Claim 15 (depends on 9) The computer program product of claim 9, wherein manipulating the form of the error frame comprises transmitting a single dominant bit in place of the expected at least one recessive bit of an error delimiter field of the error frame. ### Claim 16 (depends on 9) The computer program product of claim 9, wherein the last iteration of the interrupting the error frame is performed without the manipulating the form of the error frame.