Systems and methods for monitoring a plurality of vehicles
Systems and methods for monitoring a plurality of vehicles are provided. The method involves operating at least one processor to: determine, based on cyber risk data corresponding to a plurality of ECU models, a cyber risk score for each ECU model; receive, from each of the vehicles, one or more security logs; map, for each security log, i.) the ECU model of the ECU that recorded the security log, and ii.) the cyber risk score of the ECU model corresponding to the security log; detect a cybersecurity threat in at least some of the vehicles based on i.) at least one event in at least one security log, and ii.) at least one cyber risk score corresponding to the at least one security log; and in response to detecting the cybersecurity threat, transmit an alert indicating at least one vehicle corresponding to the at least one security log.
1 . A method for monitoring a plurality of vehicles, each vehicle comprising at least one electronic control unit (ECU), each ECU operable to monitor at least one vehicular subsystem of the corresponding vehicle, the method comprising operating at least one processor to:
determine, based on cyber risk data corresponding to a plurality of ECU models, a cyber risk score for each ECU model, the cyber risk score indicating a probability of a cybersecurity threat for the ECU model;
receive, from each of the vehicles, one or more security logs, each security log comprising one or more timestamped events recorded by an ECU of the corresponding vehicle;
for each timestamped event of the one or more timestamped events, determine i.) the ECU model of the ECU that recorded the timestamped event, and ii.) associate the cyber risk score of the ECU model with the timestamped event;
evaluate the one or more security logs to detect at least one cybersecurity threat in at least some of the vehicles by, for each timestamped event:
evaluating a severity level associated with the timestamped event to determine whether the severity level satisfies a minimum threat level;
evaluating the cyber risk score associated with the timestamped event to determine whether the cyber risk score satisfies a minimum risk level; and
indicating the at least one cybersecurity threat is present when at least one of the severity level satisfies the minimum threat level and the cyber risk score satisfies the minimum risk level; and
in response to detecting the at least one cybersecurity threat, transmit an alert indicating at least one vehicle corresponding to the at least one security log experienced the at least one cyber security threat.
2 . The method of claim 1 , wherein the alert further indicates at least one ECU model corresponding to the at least one security log.
3 . The method of claim 1 , wherein the cyber risk data is received from one or more external data sources.
4 . The method of claim 1 , wherein the cyber risk data indicates, for each ECU model, at least one cybersecurity control status of i.) the ECU model, and ii.) a manufacturer of the ECU model.
5 . The method of claim 1 , wherein the cyber risk data indicates, for each ECU model, known vulnerabilities and breaches associated with the ECU model.
6 . The method of claim 1 , further comprising operating the at least one processor to:
for each security log, append a vehicle identifier to the security log, the vehicle identifier identifying the vehicle from which the security log was received; and
wherein the alert indicates the at least one vehicle corresponding to the at least one security log based on the corresponding vehicle identifier.
7 . The method of claim 6 , wherein the cybersecurity threat is detected further based on the vehicle identifier of the at least one security log.
8 . The method of claim 1 , wherein the plurality of vehicles comprises one or more vehicle fleets, and the method further comprises operating the at least one processor to:
for each security log, append a fleet identifier to the security log, the fleet identifier identifying the vehicle fleet of the vehicle from which the security log was received; and
wherein the alert further indicates the vehicle fleet corresponding to the at least one security log based on the corresponding fleet identifier.
9 . The method of claim 8 , wherein the cybersecurity threat is detected further based on the fleet identifier of the at least one security log.
10 . The method of claim 1 , wherein the cybersecurity threat is detected in response to determining that at least one event in at least one security log meets a security log condition that is determined based on the at least one cyber risk score corresponding to the at least one security log.
11 . A non-transitory computer readable medium having instructions stored thereon executable by at least one processor to implement the method of claim 1 .
12 . The method of claim 1 further comprises operating the at least one processor to, prior to evaluating the one or more security logs,
convert the one or more security logs into a predefined format to provide the one or more timestamped events in a consistent format;
evaluate each converted security log to determine whether additional data is required to be appended to provide sufficient data for detecting the at least one cybersecurity threat; and
in response to determining the additional data is required, appending one or more data fields to the converted security log.
13 . A system for monitoring a plurality of vehicles, each vehicle comprising at least one electronic control unit (ECU), each ECU operable to monitor at least one vehicular subsystem of the corresponding vehicle, the system comprising:
at least one processor in communication with the plurality of vehicles, the at least one processor operable to:
determine, based on cyber risk data corresponding to a plurality of ECU models, a cyber risk score for each ECU model, the cyber risk score indicating a probability of a cybersecurity threat for the ECU model;
receive, from each of the vehicles, one or more security logs, each security log comprising one or more timestamped events recorded by an ECU of the corresponding vehicle;
for timestamped event of the one or more timestamped events, determine i.) the ECU model of the ECU that recorded the timestamped event, and ii.) associate the cyber risk score of the ECU model with the timestamped event;
evaluate the one or more security logs to detect at least one cybersecurity threat in at least some of the vehicles by, for each timestamped event:
evaluating a severity level associated with the timestamped event to determine whether the severity level satisfies a minimum threat level;
evaluating the cyber risk score associated with the timestamped event to determine whether the cyber risk score satisfies a minimum risk level; and
indicating the at least one cybersecurity threat is present when at least one of the severity level satisfies the minimum threat level and the cyber risk score satisfies the minimum risk level; and
in response to detecting the at least one cybersecurity threat, transmit an alert indicating at least one vehicle corresponding to the at least one security log experienced the at least one cybersecurity threat.
14 . The system of claim 13 , wherein the alert further indicates at least one ECU model corresponding to the at least one security log.
15 . The system of claim 13 , wherein the cyber risk data is received from one or more external data sources.
16 . The system of claim 13 , wherein the cyber risk data indicates, for each ECU model, at least one cybersecurity control status of i.) the ECU model, and ii.) a manufacturer of the ECU model.
17 . The system of claim 13 , wherein the cyber risk data indicates, for each ECU model, known vulnerabilities and breaches associated with the ECU model.
18 . The system of claim 13 , wherein the at least one processor is operable to:
for each security log, append a vehicle identifier to the security log, the vehicle identifier identifying the vehicle from which the security log was received; and
wherein the alert indicates the at least one vehicle corresponding to the at least one security log based on the corresponding vehicle identifier.
19 . The system of claim 18 , wherein the cybersecurity threat is detected further based on the vehicle identifier of the at least one security log.
20 . The system of claim 13 , wherein the plurality of vehicles comprises one or more vehicle fleets, and the at least one processor is operable to:
for each security log, append a fleet identifier to the security log, the fleet identifier identifying the vehicle fleet of the vehicle from which the security log was received; and
wherein the alert further indicates the vehicle fleet corresponding to the at least one security log based on the corresponding fleet identifier.
21 . The system of claim 20 , wherein the cybersecurity threat is detected further based on the fleet identifier of the at least one security log.
22 . The system of claim 13 , wherein the at least one processor is operable to:
reformat at least some of the security logs so that each security log has the same format.
23 . The system of claim 13 , wherein the at least one processor is operable to, prior to evaluating the one or more security logs,
convert the one or more security logs into a predefined format to provide the one or more timestamped events in a consistent format;
evaluate each converted security log to determine whether additional data is required to be appended to provide sufficient data for detecting the at least one cybersecurity threat; and
in response to determining the additional data is required, appending one or more data fields to the converted security log.