DETECTION SYSTEM

RELATED APPLICATIONS

[0001] The present application claims priority to U.S. Provisional Application No.

62/524,428, filed June 23, 2017, the entire contents of which is hereby incorporated by reference.

FIELD

[0002] Embodiments relate to configuration of an intrusion detection system of a vehicle. BACKGROUND

[0003] Modem vehicles are equipped with numerous computers and electrical components that control various vehicle systems. These computers and components communicate by sending and receiving messages to and from each other.

SUMMARY

[0004] The present invention relates to the configuration of intrusion detection systems for computerized, vehicle-control systems.

[0005] The messages that computers and components send and receive include a message identifier followed by a plurality of signals. It is possible to change a vehicle's behavior by disrupting communication between computers and electrical components in the vehicle.

Increasing computer connectivity in vehicle systems increases the risk that messages and signals are falsely transmitted or otherwise corrupted. Anomalies may be caused by unexpected vehicle behavior or attacks from outside sources. An intrusion detection system can be used to detect these potential anomalies.

[0006] The results of messages being improperly transmitted include, among other things, driver annoyance, driver distraction, or changes in vehicle behavior. Because messages and signals are different in different vehicles there is a need for a configuration tool that allows manufactures and suppliers of vehicles to quickly and accurately configure, simulate, and reconfigure automobile intrusion detection systems.

[0007] Embodiments provide, among other things, a system and a method for configuring an intrusion detection system.

[0008] One embodiment provides a system for configuring an intrusion detection system. The system includes an input device, a display device, and an electronic processor. The electronic processor is configured to receive input, via the input device. The input the electronic processor receives includes a previous configuration file, a data bus configuration file, and user input. The electronic processor is also configured to run, with an intrusion detection system configuration tool, a simulation of communication on a vehicle communication system based on the input received and configured to display, on the display device, results of running the simulation with the intrusion detection system configuration tool. The electronic processor is further configured to output a new configuration file and a file configured to be uploaded to a vehicle.

[0009] Another embodiment provides a method for configuring an intrusion detection system. The method includes setting a configuration value. The method also includes running, with an electronic processor, a simulation of communication on a vehicle communication system with a trace file, and generating results of the simulation. The method also includes receiving, with the electronic processor, an adjustment input for the configuration value and outputting, with the electronic processor, a file including a configuration values (or configured values) for the intrusion detection system. The output file is configured to be uploaded to a vehicle.

[0010] Other aspects, features, and embodiments will become apparent by consideration of the detailed description and accompanying drawings.

BRIEF DESCRIPTION OF THE DRAWINGS

[0011] Fig. 1 is a simplified diagram of a vehicle's communication system. [0012] Fig. 2 is a diagram of an electronic control unit for running an intrusion detection system configuration tool on an electronic processor, as well as the inputs and outputs of the electronic control unit.

[0013] Fig. 3 is a flow chart of a method for configuring an intrusion detection system with a graphical user interface.

[0014] Fig. 4 is a flow chart of a method for choosing configuration values that cause the intrusion detection system to report no errors when a simulation is run with a clean trace file.

[0015] Fig. 5 is a flow chart of a method for choosing configuration values that cause the intrusion detection system to report an error when a simulation is run with a corrupted trace file.

[0016] Fig. 6 through Fig. 15 illustrate the process of configuring the intrusion detection system using a graphical user interface.

DETAILED DESCRIPTION

[0017] Before any embodiments are explained in detail, it is to be understood that this disclosure is not intended to be limited in its application to the details of construction and the arrangement of components set forth in the following description or illustrated in the following drawings. Embodiments are capable of other configurations and of being practiced or of being carried out in various ways.

[0018] One or more embodiments are described and illustrated in the following description and accompanying drawings. These embodiments are not limited to the specific details provided herein and may be modified in various ways. Furthermore, other embodiments may exist that are not described herein. Also, the functionality described herein as being performed by one component may be performed by multiple components in a distributed manner. Likewise, functionality performed by multiple components may be consolidated and performed by a single component. Similarly, a component described as performing particular functionality may also perform additional functionality not described herein. For example, a device or structure that is "configured" in a certain way is configured in at least that way, but may also be configured in ways that are not listed. Furthermore, some embodiments described herein may include one or more electronic processors configured to perform the described functionality by executing instructions stored in non-transitory, computer-readable medium. Similarly, embodiments described herein may be implemented as non-transitory, computer-readable medium storing instructions executable by one or more electronic processors to perform the described functionality. As used in the present application, "non-transitory computer-readable medium" comprises all computer-readable media but does not consist of a transitory, propagating signal. Accordingly, non-transitory computer-readable medium may include, for example, a hard disk, a CD-ROM, an optical storage device, a magnetic storage device, a ROM (Read Only Memory), a RAM (Random Access Memory), register memory, a processor cache, or any combination thereof.

[0019] In addition, the phraseology and terminology used herein is for the purpose of description and should not be regarded as limiting. For example, the use of "including," "containing," "comprising," "having," and variations thereof herein is meant to encompass the items listed thereafter and equivalents thereof as well as additional items. The terms

"connected" and "coupled" are used broadly and encompass both direct and indirect connecting and coupling. Further, "connected" and "coupled" are not restricted to physical or mechanical connections or couplings and can include electrical connections or couplings, whether direct or indirect. In addition, electronic communications and notifications may be performed using wired connections, wireless connections, or a combination thereof and may be transmitted directly or through one or more intermediary devices over various types of networks, communication channels, and connections. Moreover, relational terms such as first and second, top and bottom, and the like may be used herein solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions.

[0020] A plurality of hardware and software based devices, as well as a plurality of different structural components may be used to implement various embodiments. In addition, embodiments may include hardware, software, and electronic components or modules that, for purposes of discussion, may be illustrated and described as if the majority of the components were implemented solely in hardware. However, one of ordinary skill in the art, and based on a reading of this detailed description, would recognize that, in at least one embodiment, the electronic based aspects of the invention may be implemented in software (for example, stored on non-transitory computer-readable medium) executable by one or more processors. For example, "control units" and "controllers" described in the specification can include one or more electronic processors, one or more memory modules including non-transitory computer-readable medium, one or more input/output interfaces, one or more application specific integrated circuits (ASICs), and various connections (for example, a system bus) connecting the various components.

[0021] Fig. 1 illustrates a communication system 100 of a vehicle 105. The vehicle 105, although illustrated as a four-wheeled vehicle, may encompass various types and designs of vehicles. For example, the vehicle 105 may be an automobile, a motorcycle, a truck, a bus, a semi-tractor, and others. In the example illustrated, the communication system 100 allows several systems (electronic control units) to communicate with each other by sending messages 110 to each other via various wired or wireless connections. Examples of systems which communicate with each other are an engine control system 115, a motion control system 120, a transmission control system 125, a brake control system 130, and the instrument panel display system 135. These systems may be of various constructions and may use various

communication types and protocols. In some embodiments, systems which communicate with each other are communicatively coupled via a shared communication link such as a vehicle communication bus (for example, a controller area network (CAN) bus) or a wireless vehicle network.

[0022] Each of the above-listed systems interacting with each other over the communication system 100 may include dedicated processing circuitry including an electronic control unit for receiving, processing, and transmitting data associated with the functions of each system. For example, the engine control system 115 includes an electronic control unit that receives messages 110, checks that there are no potentially harmful anomalies associated with the messages 110, and sends messages 110. The embodiment illustrated in Fig. 1 provides but one example of the components and connections of the communication system 100. However, these components and connections may be constructed in ways other than those illustrated and described herein. [0023] Fig. 2 illustrates a system 200 for configuring an intrusion detection system. It should be understood that in some embodiments, the system 200 includes additional, fewer, or different components than those described herein. It should also be understood that the system 200 may contain sub-modules that include additional electronic processors, memory, or application specific integrated circuits (ASICs) for handling input/output functions and application of the methods listed below. In the embodiment illustrated in Fig. 2, the system 200 includes an electronic processor 201. The electronic processor 201 included in the embodiment illustrate in Fig. 2 is configured to run an intrusion detection system configuration tool 202 and to provide a graphical user interface (GUI) for the intrusion detection system configuration tool 202. The GUI is generated by a GUI generator 203 and is displayed on a display device 204. The display device 204 may include, for example, a touchscreen, a liquid crystal display (LCD), a light-emitting diode (LED) display, an organic LED (OLED) display, an electroluminescent display (ELD), and the like. The intrusion detection system configuration tool 202 allows an intrusion detection system to be configured for different types of vehicles by, for example, simulating communication between electronic control units included in a vehicle. For example, the intrusion detection system configuration tool 202 may simulate communication between electronic control units (or systems) included in the communication system 100 of the vehicle 105. In some embodiments, the electronic processor 201 executes the intrusion detection system configuration tool 202 without connecting to the vehicle.

[0024] The system 200 includes a plurality of electrical and electronic components that provide power, operation control, and protection to the components and modules within the system 200. The system 200 includes, among other things, an electronic processor 201 (such as a programmable electronic microprocessor, microcontroller, or similar device), a memory 205 (for example, non-transitory, computer-readable medium), an input interface 206, and an output interface 207. The electronic processor 201 is communicatively connected to the memory 205, input interface 206, and output interface 207. The intrusion detection system configuration tool 202 and the GUI generator 203 are stored in the memory 205 and configured to be executed by the electronic processor 201. The electronic processor 201, in coordination with the memory 205, the input interface 206, and output interface 207, is configured to implement, among other things, the methods described herein. [0025] In one example, when executing the intrusion detection system configuration tool 202 the electronic processor 201 receives, as input, a selection of an old configuration file 210 for an intrusion detection system, a selection of a data bus configuration (DBC) file 215, and user input 220, via an input device 221 connected to the input interface 206. The input device 221 may be, for example, a keypad, a mouse, a touchscreen, a microphone, a camera, or the like. When running the intrusion detection system configuration tool 202, the electronic processor 201 outputs or generates, via the output interface 207, a simulation results log file 225 (a log file), a new configuration file 230 for the intrusion detection system, and a binary file 235. In some embodiments, the results 240 of the simulation included in the simulation results log file 225 are displayed on the display device 204 that is connected to the output interface 207. The old configuration file 210 contains previously selected configuration values for the intrusion detection system. The DBC file 215 is defined as a file containing a database of messages and signals associated with the vehicle 105 (the vehicle with the intrusion detection system that the configuration values are for). The electronic processor 201, when executing the intrusion detection system configuration tool 202, uses the DBC file 215 to run a simulation of communication on a vehicle communication system (for example, the communication system 100 of the vehicle 105) to test the configuration values for the intrusion detection system. The new configuration file 230 contains data associated with current configuration values for the intrusion detection system. The binary file 235 is a file used to upload the current configuration values for the intrusion detection system to the vehicle 105.

[0026] The user input 220 may include, among other things, adjusted configuration values. In certain instances, the electronic processor 201 sets the configuration values based on the user input 220. Configuration values are associated with messages and signals. An example of a configuration value associated with the messages 110 is a message identifier. Another example of a configuration value is a predetermined period of time. If the electronic processor 201 receives more than one message with the same message identifier within the predetermined period of time, the electronic processor 201 records an anomaly (for example, a piggy-backing error). Examples of configuration values associated with messages 110 also include an upper threshold and a lower threshold for the number of messages 110 that may be received within a predetermined time period (for example, an upper limit and a lower limit for the rate that messages 110 are received) without causing the electronic processor 201 to detect an anomaly. Other examples of configuration values include a location of reserved bits where no signal is defined in the messages 1 10 and predetermined requirement for valid message length. The predetermined requirement for valid message length may be a minimum message length, a maximum message length, or other message length. Examples of configuration values associated with signals include a range that the signals should not be in (for example, an invalid range) and a range that the signals should be in (for example, a valid range). The valid range and invalid range are, for example, a range of linear values. In some embodiments, configuration values associated with the signals are the signal values included in a table of valid signal values. If the value of a signal is not in the table of valid signal values, the electronic processor 201 , for example, generates an error message. In other embodiments, configuration values associated with the signals are the signal values included in a table of invalid signal values. If the value of a signal is in the table of invalid signal values, the electronic processor 201, for example, generates an error message. Another configuration value associated with the signals is, for example, a predetermined threshold rate that the value of a signal changes.

[0027] Fig. 3 illustrates an example method 300 for configuring an intrusion detection system. When a first simulation is run using the intrusion detection system configuration tool 202 (block 302), the electronic processor 201 receives a selection of a plurality of buses and a selection of communication components to monitor (block 305). When the electronic processor 201 receives a selection of a plurality of buses, the electronic processor 201 runs a simulation to test, for example, a subset of the configuration values of electronic control units, messages, and signals associated with the selected plurality of buses. The communication components the electronic processor 201 may receive a selection of include buses, electronic control units, signals, and messages 1 10. In some embodiments, monitoring includes the electronic processor 201 performing in depth testing of the configuration values of the selected communication component. As described in further detail below, the electronic processor 201 preforms in depth testing (for example, by testing all the configuration values associated with a message, performing multiple tests for a configuration value associated with a message, or both). The electronic processor 201 also receives a selection of configuration values (block 308). The electronic processor 201 then runs a simulation using the selected configuration values (block 309). Running the simulation causes the electronic processor 201 to generate the results 240 of the simulation. As described in greater detail in Fig. 4, the electronic processor 201 continues receiving modifications to the configuration values (adjustment input) and running simulations until a predetermined number of simulations are run and each simulation that is run results in no false positives (block 310). False positives occur, for example, when the intrusion detection system detects an anomaly but the intrusion detection system should not have detected the anomaly.

[0028] Fig. 4 illustrates a method 400 for eliminating false positives from the results 240 of each simulation. The electronic processor 201 receives a selection of a plurality of configuration values (block 402), and runs a simulation with a clean trace file (block 405). A clean trace file contains message data for testing current configuration values for the intrusion detection system. The message data in the clean trace file does not contain data that should cause the intrusion detection system to detect an anomaly. In some embodiments, if there is a false positive in the results 240 of the simulation (block 410), the electronic processor 201 receives adjustment input, changes a plurality of configuration values associated with the communication components of the intrusion detection system based on the adjustment input (block 402), and runs the simulation again with the clean trace file (block 405). In other embodiments, the electronic processor 201 may automatically adjust the plurality configuration values based on the results 240 of the simulation. If running the simulation does not result in any false positives, the electronic processor 201 determines if there have been enough simulations run with different clean trace files (block 415). For example, the electronic processor 201 may compare the number of simulations run with different clean trace files to a predetermined value in order to determine if there have been enough simulations run with different clean trace files. If there have not been enough simulations run with different clean trace files, the electronic processor 201 chooses a new clean trace file (block 420) and runs a simulation with the new clean trace file (block 405). The results 240 of the simulation run are stored in the simulation results log file 225 and the results 240 of the simulation included in the simulation results log file 225 are displayed in the GUI on the display device 204. Once no false positives are detected and there have been enough simulations run with different clean trace files, the method 400 is complete (block 425).

[0029] Returning to Fig. 3, the electronic processor 201 runs simulations (block 309) and receives modifications to the configuration values until the results 240 of each simulation include no false negatives (block 315). False negatives occur when the intrusion detection system should detect an anomaly but the intrusion detection system does not detect the anomaly.

[0030] Fig. 5 illustrates an example method 500 for eliminating false negatives from the results 240 of each simulation. In the example shown, the electronic processor 201 receives a selection of a plurality of configuration values (block 502) runs a simulation with a corrupted trace file (block 505). A corrupted trace file contains message data used to test current configuration values for the intrusion detection system. The message data in the corrupted trace file contains data which should cause the intrusion detection system to detect an anomaly. If there is a false negative in the results 240 of the simulation (block 510), the user changes the configuration values (block 502) and runs the simulation again with the corrupted trace file (block 505). If running the simulation does not result in any false negatives, the electronic processor 201 determines if there have been enough simulations run with different corrupt trace files (block 515). For example, the electronic processor 201 may compare the number of simulations run with different corrupted trace files to a predetermined value in order to determine if there have been enough simulations run with different corrupted trace files. If there have not been enough simulations run with different corrupt trace files, the electronic processor 201 chooses a new corrupt trace file (block 520) and runs the simulation with the new corrupt trace file (block 505). The results 240 of the simulation run are stored in the simulation results log file 225 and the results 240 of the simulation included in the simulation results log file 225 are displayed in the GUI on the display device 204. Once no false negatives are detected and there have been enough simulations run with different corrupt trace files the method 500 for eliminating false negatives from the results 240 of each simulation is complete (block 525).

[0031] Returning again to Fig. 3, once the results 240 of each simulation no longer include false positives, false negatives, or both, the binary file 235, output by the intrusion detection system configuration tool 202 (block 318), may be uploaded to the vehicle 105 (block 320). As stated above, the binary file 235 is a file used to upload the current configuration values of the intrusion detection system to the vehicle 105 (block 320). The intrusion detection system is tested within the vehicle 105 with the configuration values in the binary file 235. If the intrusion detection system within the vehicle 105 (using the configuration values in the binary file 235) does not detect false positives, false negatives, or both (block 325), the method 300 ends (block 330). If the intrusion detection system within the vehicle 105 (using the configuration values in the binary file 235) detects false positives, false negatives, or both (block 325), the method 300 begins again.

[0032] Fig. 6 illustrates an example window 600 displayed on the display device 204 in the GUI generated by the GUI generator 203. In the example provided, the window 600 allows a user to access the intrusion detection system configuration tool 202. In the window 600, a user may import the DBC file 215 by selecting an option 605 in a drop down menu 610. The drop down menu 610 also includes an option 615 for exporting a binary file, for example, the binary file 235 including configuration values.

[0033] Fig. 7 illustrates an example configuration file and a drop down menu 700 for the configuration file within the window 600. In some embodiments, receiving a selection of an open option 705 included in the drop down menu 700 causes the electronic processor 201 to open a previously saved configuration file (for example, old configuration file 210). In the illustrated example, when the old configuration file 210 opens, the electronic processor 201 displays (for example, in a pane 707) configuration values included in the old configuration file 210. In some embodiments, a save option 710 and a save as option 715 included in the drop down menu 700 allow the user to create a new configuration file 230 to be exported.

[0034] In Fig. 8, a dialogue box 800 that allows a user to select a plurality of buses is illustrated. The electronic processor 201 tests a subset of the configuration values of the electronic control units, messages, and signals associated with the selected plurality of buses during the configuration process (block 305 of Fig. 3).

[0035] Fig. 9 and Fig. 10 illustrate example elements of the GUI that allow a user to select communication components to monitor. Fig. 9 illustrates a pane 900 in the window 600 that allows a user to select electronic control units to monitor during the configuration process. In some embodiments, the electronic processor 201 receives a selection of electronic control units to monitor when a user clicks on checkboxes (for example, checkbox 905) displayed next to a name (for example, electronic control unit name 910) of each electronic control unit. When a checkbox contains a checkmark, the electronic control unit whose name is next to the checked checkbox is selected to be monitored by the electronic processor 201. When the electronic processor 201 receives a selection of an electronic control unit, the electronic processor 201 monitors the messages 1 10 and signals associated with the selected electronic control unit during the configuration process. In some embodiments, when a user selects (for example, by clicking) a checked checkbox, the electronic processor 201 receives a selection of an electronic control unit not to monitor.

[0036] Fig. 10 illustrates a pane 1000 in the window 600 that allows a user to select messages (from the messages associated with electronic control units the user selected) to monitor during the configuration process. In the example provided, a user selects and unselects messages by clicking on the checkboxes (for example, checkbox 1005) displayed next to a name (for example, message name 1010) of each message. When a checkbox contains a checkmark, the message whose name is next to the checked checkbox is selected to be monitored by the electronic processor 201. Selecting a message in the pane 1000 causes each signal carried by the message to appear in a pane 1015. In some embodiments, when a user selects (for example, by clicking) a checked checkbox, the electronic processor 201 receives a selection of a message not to monitor. In some embodiments, a selection of signals to monitor, a selection of signals not to monitor, or both may be received by the electronic processor 201 via GUI elements similar to the GUI elements described in Fig. 9 and Fig. 10.

[0037] Fig. 1 1 illustrates the electronic processor 201 receiving modifications to

configuration values for one or more signals carried within the messages when a user enters values via a signal dialogue box 1 100. In the example shown, if the user selects the signal 1 105 from a pane 1 1 10, then the signal dialogue box 1 100 is displayed in the GUI. The electronic processor 201 receives configuration values when the user enters values in the text fields (for example the text field 1 1 15) of the signal dialogue box 1 100. In some embodiments, the electronic processor 201 receives modifications to configuration values for one or more messages when the user enters values in the text fields via a dialogue box that is, for example, similar to the signal dialogue box 1 100.

[0038] Fig. 9 through Fig. 13 also illustrate a pane 1 120 that allows a user to select communication components to monitor and change the configuration values of the intrusion detection system. In the example illustrated, the pane 1 120 displays a plurality of bus names and an arrow next to each bus name (for example, the bus name 1125 and the arrow 1130). When a user, for example, selects the arrow or the bus name, a drop down menu appears in the pane 1120. In the example illustrated, the drop down menu includes three options with arrows next to each option. The options included in the drop down menu are electronic control units 1 135, messages 1140, and signals 1145. When the electronic processor 201 receives a selection of an option in the drop down menu each electronic control unit, message, or signal associated with the bus name is displayed within the pane 1120, depending on which option was selected. For example, if the electronic processor 201 receives a selection of the messages 1140, each message associated with the bus name 1125 is displayed in the pane 1120. When an electronic control unit, a message, or a signal is selected from the electronic control units, messages, and signals associated with the bus name, the electronic processor 201 may monitor the selected electronic control unit, a message, or a signal. If a message or a signal is selected from the messages and signals associated with the bus name, the electronic processor 201 may display dialogue box (similar to the signal dialogue box 1100, for example) and receive a selection of configuration values (adjustment input).

[0039] It should be understood that methods and GUI elements for selecting communication components to monitor and for changing configuration values, other than the methods and GUI elements described above, are possible. Therefore, the embodiments described herein should not be considered to be in any way limiting.

[0040] Fig. 12 illustrates a simulation configuration dialogue box 1200 for running a simulation using a clean trace file. In the example shown, the clean trace file is specified in a text field 1205 of the simulation configuration dialog box labeled "ASC File Path." The electronic processor 201 records anomalies it detects when running the simulation with the clean trace file in the simulation results log file 225. The simulation results log file 225 is specified in a text field 1210 of the simulation configuration dialog box, labeled "Report File Path."

[0041] Fig. 13 illustrates an example pop-up message 1300 that is displayed on the display device 204, according to some embodiments, when the simulation is running. In other embodiments, pop-up messages, dialogue boxes, windows, and the like may be displayed in place of the pop-up message 1300. In yet other embodiments, no indication that a simulation is running is displayed.

[0042] Fig. 14 illustrates an example embodiment in which a pop-up message 1400 displayed on the display device 204 when the simulation is complete. In other embodiments, pop-up messages, dialogue boxes, windows, and the like may be displayed in place of the pop-up message 1400. In yet other embodiments, no indication that the simulation is complete is displayed. Anomalies detected by the electronic processor 201 during the simulation run are recorded in the simulation results log file 225 specified in the text field 1210 labeled "Report File Path."

[0043] Fig. 15 is an example of contents of the simulation results log file 225 (the results 240 of the simulation) in which information regarding anomalies detected during a simulation is recorded. In the embodiment shown in Fig 15, the results 240 of the simulation included in the simulation results log file 225 are displayed within a window 1500 of the GUI after a simulation is run. In other embodiments, the results 240 of the simulation included in the simulation results log file 225 are displayed within the window 600.

[0044] Various features, advantages, and embodiments are set forth in the following claims.