US 12,309,184 B2
System and method for providing security to in-vehicle network
Seung Wook Park, Seoul (KR); Seil Kim, Seoul (KR); and Aram Cho, Seoul (KR)
Assigned to Hyundai Motor Company, Seoul (KR); and Kia Corporation, Seoul (KR)
Filed by Hyundai Motor Company, Seoul (KR); and Kia Corporation, Seoul (KR)
Filed on Nov. 6, 2023, as Appl. No. 18/387,375.
Application 18/387,375 is a continuation of application No. 16/771,904, granted, now 11,848,947, previously published as PCT/KR2019/000832, filed on Jan. 21, 2019.
Claims priority of provisional application 62/620,754, filed on Jan. 23, 2018.
Prior Publication US 2024/0073233 A1, Feb. 29, 2024
This patent is subject to a terminal disclaimer.
Int. Cl. H04L 29/06 (2006.01); H04L 9/40 (2022.01)
CPC H04L 63/1425 (2013.01) [H04L 63/029 (2013.01); H04L 63/1416 (2013.01); H04L 63/20 (2013.01)] 14 Claims
OG exemplary drawing
 
1. An electronic device connected to an in-vehicle network, for providing security to the in-vehicle network, the electronic device comprising:
at least one processor; and
a memory in which instructions are recorded, wherein the instructions, when executed by the at least one processor, cause the at least one processor to implement:
a message queue module configured to store network messages collected from the in-vehicle network in a message queue;
a storage configured to store a rule set used in a plurality of detection techniques; and
a rule engine configured to update the rule set stored in the storage with a new rule set downloaded from a backend server on an external network, and sequentially apply the plurality of detection techniques to a collected network message so as to determine whether the collected network message is a security threat message, the plurality of detection techniques including a static detection technique, a misuse detection technique, and an anomaly detection technique, and
wherein the rule engine is further configured to:
apply to the collected network message the static detection technique, the misuse detection technique, and the anomaly detection technique in an order as recited; and
bypass a subsequent application of remaining detection techniques to the collected network message in response to any one of the plurality of detection techniques determining the collected network message as a security threat message, thereby minimize the execution of the anomaly detection technique that is relatively time-consuming, requires relatively high computational power and causes false positive problems relatively frequently compared to the static detection technique and the misuse detection technique.