US 12,301,591 B2
System and method for connected vehicle cybersecurity
Yonatan Appel, Ramat Hasharon (IL); and Yoav Levy, Kfar-Vitkin (IL)
Assigned to Upstream Security, Ltd., Herzliya (IL)
Filed by Upstream Security, Ltd., Herzliya (IL)
Filed on Mar. 30, 2022, as Appl. No. 17/657,187.
Application 17/657,187 is a continuation of application No. 16/047,444, filed on Jul. 27, 2018, granted, now 11,477,212.
Claims priority of provisional application 62/537,608, filed on Jul. 27, 2017.
Prior Publication US 2022/0224700 A1, Jul. 14, 2022
This patent is subject to a terminal disclaimer.
Int. Cl. H04L 9/40 (2022.01); G06N 20/00 (2019.01); H04W 4/44 (2018.01)
CPC H04L 63/1416 (2013.01) [G06N 20/00 (2019.01); H04L 63/1441 (2013.01); H04L 63/20 (2013.01); H04W 4/44 (2018.02)] 21 Claims
OG exemplary drawing
 
1. A method for connected vehicle cybersecurity, comprising:
creating, by a remote system, a normal behavior model based on a first set of data, the first set of data including at least one first event with respect to at least one connected vehicle, wherein the first set of data is collected from a plurality of data sources, wherein the at least one connected vehicle is a plurality of connected vehicles, wherein the plurality of connected vehicles is a fleet of connected vehicles organized in a hierarchy, and wherein the remote system is remote from the fleet of connected vehicles;
clustering the first set of data based on the hierarchy wherein the hierarchy includes at least one sub-fleet of the plurality of connected vehicles;
creating a sub-fleet normal behavior model for each sub-fleet;
detecting, by the remote system, an anomaly based on the normal behavior model and a second set of data, the second set of data including at least one second event with respect to the at least one connected vehicle, wherein each of the first set of data and the second set of data includes vehicle data related to operation of the at least one connected vehicle, wherein each event represents a communication with the at least one connected vehicle and wherein the anomaly is detected based further on the sub-fleet normal behavior models;
determining, based on the detected anomaly, at least one mitigation action; and
causing implementation of the at least one mitigation action.