Systems and methods for platform agnostic distributed intrusion detection
AssigneeCymotive Technologies Ltd.
InventorEugene SHUBOV
Life of this patent
Estimating the term…
Abstract
Presented herein are methods and systems describing distributed intrusion detection system architectures that, in one embodiment, include one or more network sensors; one or more intrusion detection agents; an intrusion detection proxy; and rules logic distributed across the one or more intrusion detection agents and the intrusion detection proxy; wherein the rules logic is configured to be executed within an isolated computing environment. Other non-limiting embodiments are described and claimed herein.
Claims20
A distributed intrusion detection system architecture comprising:
- a) one or more network sensors;
- b) one or more intrusion detection agents deployed on at least one electronic control unit (ECU);
- c) an intrusion detection proxy deployed on a second electronic control unit (ECU);
- and
- d) rules logic distributed across the one or more intrusion detection agents and the intrusion detection proxy;
- wherein the rules logic is configured to be executed within an isolated computing environment deployed on each of the one or more intrusion detection agents deployed on the at least one (ECU), and on the intrusion detection proxy deployed on the second ECU.
A distributed intrusion detection method comprising:
- a) accepting data via one or more sensing nodes;
- b) performing anomaly detection on the data via one or more intrusion detection agents deployed on at least one electronic control unit (ECU);
- c) accepting one or more notifications of at least one anomaly from the one or more intrusion detection agents via an intrusion detection proxy deployed on a second electronic control unit (ECU);
- and
- d) applying rules logic distributed across the one or more intrusion detection agents and the intrusion detection proxy;
- wherein the rules logic is configured to be executed within an isolated computing environment deployed on each of the one or more intrusion detection agents deployed on the at least one ECU, and on the intrusion detection proxy deployed on the second ECU.
A non-transitory computer program product comprising instructions, which when executed by one or more processors, cause the one or more processors to:
- a) accept data via one or more sensing nodes;
- b) perform anomaly detection on the data via one or more intrusion detection agents deployed on at least one electronic control unit (ECU);
- c) accept one or more notifications of at least one anomaly from the one or more intrusion detection agents via an intrusion detection proxy deployed on a second electronic control unit (ECU);
- and
- d) apply rules logic distributed across the one or more intrusion detection agents and the intrusion detection proxy;
- wherein the rules logic is configured to be executed within an isolated computing environment deployed on each of the one or more intrusion detection agents deployed on the at least one ECU, and on the intrusion detection proxy deployed on the second ECU.
Dependencies are inferred from the claim text.