Sensor data anomaly detector
Methods and systems are provided that are effective to generate an alarm for a vehicle. The methods include receiving, by a device, a first sensor value from a first sensor for the vehicle. The methods further include receiving, by the device, a second sensor value from a second sensor for the vehicle. The methods further include retrieving, by the device, an instruction from a memory disposed in the vehicle while the memory is in a write-protected mode. The methods further include evaluating, by the device, the first sensor value and the second sensor value based on the instruction. The methods further include determining, by the device, that the first sensor value is outside a range associated with the first sensor based on the evaluation. The methods further include transforming, by the device, the determination into an alarm.
1. A method to detect an attack on a vehicle, the method comprising:
receiving a sensor value from a sensor associated with the vehicle;
in response to receiving the sensor value, generating sample data to be written onto a memory which is disposed in the vehicle;
attempting to write the generated sample data to the memory;
detecting the attack on the vehicle, wherein the detection of the attack is based on a determination that the attempt to write the generated sample data to the memory is unsuccessful; and
generating an alarm that is indicative of the detected attack on the vehicle.
2. The method of claim 1 , wherein receiving the sensor value from the sensor comprises receiving a value of a speed of the vehicle from a speedometer associated with the vehicle.
3. The method of claim 1 , wherein the memory is configured to operate in one of a write-access mode and a write-protected mode.
4. The method of claim 3 , further comprising:
activating the write-access mode for the memory, while the vehicle is stopped; and
activating the write-protected mode for the memory, while the vehicle is in motion.
5. The method of claim 1 , wherein detecting the attack on the vehicle comprises detecting one of a jamming attack, a spoofing attack, or a root gaining attack.
6. A method to generate an alarm for a vehicle, the method comprising:
receiving a sensor value from a sensor associated with the vehicle;
determining a current mode of operation of a memory disposed in the vehicle, wherein the memory is configured to be in communication with the sensor;
evaluating whether the sensor value corresponds to the current mode of operation of the memory; and
generating the alarm, which indicates an error related to the sensor, in response to an evaluation that the sensor value does not correspond to the current mode of operation of the memory.
7. The method of claim 6 , further comprising:
modifying the sensor value in response to the evaluation that the sensor value does not correspond to the current mode of operation of the memory.
8. The method of claim 6 , wherein the memory is configured to operate in one of a write-access mode or a write-protected mode.
9. The method of claim 6 , further comprising:
in response to an evaluation that the sensor value corresponds to the current mode of operation of the memory:
retrieving an instruction from the memory;
analyzing the sensor value based on the instruction;
determining, based on the analysis, that the sensor value is outside a range associated with the sensor; and
transforming the determination that the sensor value is outside the range, into the alarm.
10. The method of claim 9 , wherein the range is based on historical data that corresponds to the sensor.
11. A system configured to generate an alarm for a vehicle, the system comprising:
a sensor for the vehicle; and
a processor in communication with the sensor, wherein the processor is configured to:
receive a sensor value from the sensor;
receive historical data that corresponds to the sensor;
determine a difference between the sensor value and the historical data;
receive an instruction, while a memory disposed in the vehicle is in a write-protected mode;
determine, based on the instruction, whether the sensor value is consistent with the historical data;
determine, based on the difference and on a determination that the sensor value is inconsistent with the historical data, that the sensor value is outside a range which is associated with the sensor, wherein the range is based on the historical data; and
transform the determination that the sensor value is outside the range, into the alarm, to indicate that the sensor value is an anomaly.
12. The system of claim 11 , wherein the processor is configured to:
receive a model, wherein the model includes the historical data; and
store the model in the memory disposed in the vehicle, while the memory is operating in a write-access mode.
13. The system of claim 12 , wherein the processor is further configured to:
activate the write-access mode for the memory, while the vehicle is stopped; and
activate the write-protected mode for the memory, while the vehicle is in motion.
14. The system of claim 11 , wherein the sensor value corresponds to a location of the vehicle.
15. The system of claim 11 , wherein the sensor value includes a first sensor value and the sensor includes a first sensor, and wherein the processor is further configured to:
receive a second sensor value from a second sensor associated the vehicle;
receive a third sensor value from a third sensor disposed outside of the vehicle;
compute a first difference between the first sensor value and the third sensor value; and
compute a second difference between the second sensor value and the third sensor value,
wherein the determination that the sensor value is outside the range is further based on the computed first difference and the computed second difference.
16. A system to detect an attack on a vehicle, the system comprising:
a sensor for the vehicle; and
a processor in communication with the sensor, wherein the processor is configured to:
receive a sensor value from the sensor;
in response to the received sensor value, generate sample data to be written onto a memory which is disposed in the vehicle;
attempt to write the generated sample data to the memory;
detect the attack on the vehicle, wherein the detection of the attack is based on a determination that the attempt to write the generated sample data to the memory is unsuccessful; and
generate an alarm that is indicative of the detected attack on the vehicle.
17. The system of claim 16 , wherein the memory is configured to operate in one of a write-access mode and a write-protected mode.
18. The system of claim 17 , wherein the processor is further configured to:
activate the write-access mode for the memory, while the vehicle is stopped; and
activate the write-protected mode for the memory, while the vehicle is in motion.
19. A system, comprising:
a sensor for a vehicle; and
a processor in communication with the sensor, wherein the processor is configured to:
receive a sensor value from the sensor;
determine a current mode of operation of a memory disposed in the vehicle, wherein the memory is configured to be in communication with the sensor;
evaluate whether the sensor value corresponds to the current mode of operation of the memory; and
generate an alarm that indicates an error related to the sensor, in response to an evaluation that the sensor value does not correspond to the current mode of operation of the memory.
20. The system of claim 19 , wherein in response to an evaluation that the sensor value corresponds to the current mode of operation of the memory, the processor is configured to:
retrieve an instruction from the memory, while the current mode of operation of the memory is a write-protected mode;
analyze the sensor value based on the instruction;
determine, based on the analysis, that the sensor value is outside a range associated with the sensor; and
transform the determination that the sensor value is outside the range, into the alarm.
21. A system configured to generate an alarm for a vehicle, the system comprising:
a first sensor for the vehicle;
a second sensor for the vehicle;
a memory configured to store instructions to evaluate sensor values of the first sensor and the second sensor; and
a processor configured to be in communication with the first sensor, the second sensor, and the memory, wherein the processor is configured to perform or cause to be performed operations that comprise:
generate a model, wherein the model includes historical data that corresponds to the first sensor;
store the model in the memory;
evaluate, based on the instructions, a first sensor value from the first sensor and a second sensor value from the second sensor;
determine a difference between the first sensor value and the historical data;
determine, based on the evaluation and on the determined difference, that the first sensor value is outside a range associated with the first sensor, wherein the range is based on the historical data that corresponds to the first sensor; and
generate the alarm, in response to the determination that the first sensor value is outside the range, to indicate that the sensor value is an anomaly.
22. The system of claim 21 , wherein the memory is configured to operate in one of a write-access mode and a write-protected mode.
23. The system of claim 22 , wherein the operations further comprise:
activate the write-access mode for the memory, while the vehicle is stopped; and
activate the write-protected mode for the memory, while the vehicle is in motion.
24. A method to detect an attack on a vehicle, the method comprising:
receiving a first sensor value from a first sensor for the vehicle;
receiving a second sensor value from a second sensor for the vehicle;
generating a model, wherein the model includes historical data that corresponds to the first sensor;
storing the model in a memory, wherein the memory includes instructions to evaluate the first sensor value and the second sensor value;
evaluating, based on the instructions, the first sensor value and the second sensor value;
determining a difference between the first sensor value and the historical data;
determining, based on the evaluation and the determined difference, that the first sensor value is outside a range associated with the first sensor, wherein the range is based on the historical data that corresponds to the first sensor; and
generating an alarm, in response to the determination that the first sensor value is outside the range, to indicate the detection of the attack on the vehicle.
25. The method of claim 24 , wherein the memory is configured to operate in one of a write-access mode and a write-protected mode.
26. The method of claim 25 , further comprising:
activating the write-access mode for the memory, while the vehicle is stopped; and
activating the write-protected mode for the memory, while the vehicle is in motion.