US 12,395,520 B1
Detection of abnormal operations in connected vehicles
Yi-Li Cheng, Taipei (TW); Chih-Kang Lu, Taipei (TW); Zhi-Wei Chen, Taipei (TW); and Yi-Ting Chen, Taipei (TW)
Assigned to VicOne Corporation, Tokyo (JP)
Filed by VicOne Corporation, Tokyo (JP)
Filed on Mar. 20, 2023, as Appl. No. 18/186,741.
Int. Cl. H04L 9/40 (2022.01)
CPC H04L 63/1441 (2013.01) 15 Claims
OG exemplary drawing
 
1. A connected vehicle comprising:
a first electronic control unit (ECU) of a plurality of ECUs of the connected vehicle, the first ECU comprising a processor and a memory, the memory of the first ECU storing instructions that when executed by the processor of the first ECU cause the first ECU to constrain a first set of entities that are running in the first ECU to within a first security boundary that includes a first security gateway; and
a second ECU of the plurality of ECUs of the connected vehicle, the second ECU comprising a processor and a memory, the memory of the second ECU storing instructions that when executed by the processor of the second ECU cause the second ECU to:
constrain a second set of entities that are running in the second ECU to within a second security boundary that includes a second security gateway;
receive all messages between entities that are transmitted across the first and second security boundaries over a connection that is not directly accessible to any entity of the first and second sets of entities, wherein the connection is between the first and second security gateways;
receive over the connection a target message for inspection, the target message being sent by a first entity of the first set of entities to a second entity of the second set of entities;
normalize a content of the target message to a target posture vector, the target posture vector indicating a current operation involving the second entity;
compare the target posture vector to a corresponding baseline posture vector, wherein the corresponding baseline posture vector indicates a known good operation involving the second entity;
determine a difference between the target posture vector and the corresponding baseline posture vector; and
take a corrective action against the target message in response to determining that the difference between the target posture vector and the corresponding baseline posture vector indicates a change in cybersecurity posture that is prohibited by a security policy.