Detecting anomalies online using historical controller processing activity
Disclosed embodiments relate to identifying Electronic Control Unit (ECU) anomalies in a vehicle. Operations may include monitoring, in the vehicle, data representing real-time processing activity of the ECU; accessing, in the vehicle, historical data relating to processing activity of the ECU, the historical data representing expected processing activity of the ECU; comparing, in the vehicle, the real-time processing activity data with the historical data, to identify at least one anomaly in the real-time processing activity of the ECU; and implementing a control action for the ECU when the at least one anomaly is identified.
1. A non-transitory computer-readable medium including instructions that, when executed by at least one processor, cause the at least one processor to perform operations for identifying controller anomalies, comprising:
accessing real-time processing activity data of a first controller;
accessing historical data relating to processing activity, the historical data comprising data from a second controller and being represented by at least one of a model or a map developed through a machine learning or statistical analysis technique;
comparing the real-time processing activity data with the historical data, to identify at least one anomaly in the real-time processing activity of the first controller; and
implementing a control action for the first controller when the at least one anomaly is identified, the control action comprising issuing a prompt to adjust the first controller from executing a first version of controller software to a second version of controller software by using a first delta file corresponding to differences between the first and second versions of controller software, wherein the first delta file is stored on the first controller adjacent to either:
the first version of the controller software; or
a second delta file.
2. The non-transitory computer-readable medium of claim 1 , wherein the second delta file corresponds to differences between the first version of controller software and a third version of controller software.
3. The non-transitory computer readable medium of claim 1 , wherein the at least one anomaly corresponds to at least one memory location used by the first controller.
4. The non-transitory computer readable medium of claim 1 , wherein the at least one anomaly corresponds to a sequence of memory locations used by the first controller.
5. The non-transitory computer readable medium of claim 1 , wherein the at least one anomaly corresponds to at least one peak in data flow in or out of the first controller.
6. The non-transitory computer readable medium of claim 1 , wherein the at least one anomaly corresponds to at least one peak in data processing by a processor of the first controller.
7. The non-transitory computer readable medium of claim 1 , wherein the at least one anomaly corresponds to at least one anomaly in power consumption of the first controller.
8. The non-transitory computer readable medium of claim 1 , wherein the control action further comprises sending an alert associated with the first controller.
9. The non-transitory computer readable medium of claim 1 , wherein the control action further comprises blocking an instruction sent from the first controller.
10. The non-transitory computer readable medium of claim 1 , wherein the second controller is determined to be comparable to the first controller.
11. The non-transitory computer readable medium of claim 10 , wherein the second controller is determined to be comparable based on at least one of:
control functions of the first and second controllers; or
rules associated with the first version of controller software and rules associated with the second version of controller software.
12. A computer-implemented method for identifying controller anomalies, the method comprising:
accessing real-time processing activity data of a first controller;
accessing historical data relating to processing activity, the historical data comprising data from a second controller and being represented by at least one of a model or a map developed through a machine learning or statistical analysis technique;
comparing the real-time processing activity data with the historical data, to identify at least one anomaly in the real-time processing activity of the first controller; and
implementing a control action for the first controller when the at least one anomaly is identified, the control action comprising issuing a prompt to adjust the first controller from executing a first version of controller software to a second version of controller software by using a first delta file corresponding to differences between the first and second versions of controller software, wherein the first delta file is stored on the first controller adjacent to either:
the first version of the controller software; or
a second delta file.
13. The computer-implemented method of claim 12 , wherein the second delta file corresponds to differences between the first version of controller software and a third version of controller software.
14. The computer-implemented method of claim 12 , wherein the at least one anomaly corresponds to at least one memory location used by the first controller.
15. The computer-implemented method of claim 12 , wherein the at least one anomaly corresponds to a sequence of memory locations used by the first controller.
16. The computer-implemented method of claim 12 , wherein the at least one anomaly corresponds to at least one peak in data flow in or out of the first controller.
17. The computer-implemented method of claim 12 , wherein the at least one anomaly corresponds to at least one peak in data processing by a processor of the first controller.
18. The computer-implemented method of claim 12 , wherein the at least one anomaly corresponds to at least one anomaly in power consumption of the first controller.