Detecting anomalies online using controller processing activity
Disclosed embodiments relate to identifying Electronic Control Unit (ECU) anomalies in a vehicle. Operations may include monitoring, in the vehicle, data representing real-time processing activity of the ECU; accessing, in the vehicle, historical data relating to processing activity of the ECU, the historical data representing expected processing activity of the ECU; comparing, in the vehicle, the real-time processing activity data with the historical data, to identify at least one anomaly in the real-time processing activity of the ECU; and implementing a control action for the ECU when the at least one anomaly is identified.
1. A non-transitory computer-readable medium including instructions that, when executed by at least one processor, cause the at least one processor to perform operations for identifying controller anomalies, comprising:
accessing real-time processing activity data of a first controller;
accessing controller data represented by at least one of a model or a map developed through a machine learning or statistical analysis technique;
comparing the real-time processing activity data with the controller data, to identify at least one anomaly in the real-time processing activity of the first controller; and
implementing a control action for the first controller based on the identification of the at least one anomaly, the control action comprising causing the first controller to adjust from executing a first version of controller software to a second version of controller software by using a first delta file corresponding to differences between the first and second versions of controller software, wherein the first delta file is stored on the first controller adjacent to either:
the first version of the controller software; or
a second delta file.
2. The non-transitory computer-readable medium of claim 1 , wherein the controller data is based on data from a second controller.
3. The non-transitory computer-readable medium of claim 2 , wherein the data from the second controller comprises real-time processing activity data.
4. The non-transitory computer-readable medium of claim 2 , wherein the first controller and second controller are part of a same system.
5. The non-transitory computer-readable medium of claim 2 , wherein the first controller and second controller are parts of separate systems.
6. The non-transitory computer-readable medium of claim 1 , wherein the controller data is based on historical data from the first controller.
7. The non-transitory computer-readable medium of claim 1 , wherein the controller data is based on monitoring a predetermined set of functionalities of one or more controllers.
8. The non-transitory computer-readable medium of claim 1 , wherein the at least one anomaly corresponds to at least one of:
a memory location used by the first controller;
a sequence of memory locations used by the first controller;
an anomalous data flow in or out of the first controller;
a data processing anomaly by a processor of the first controller; or
an anomaly in power consumption of the first controller.
9. The non-transitory computer-readable medium of claim 1 , wherein the first controller is configured to utilize the first delta file without requiring modification to current software on the first controller.
10. The non-transitory computer-readable medium of claim 1 , wherein the first controller is configured to utilize the first delta file without requiring a reboot of the first controller.
11. The non-transitory computer-readable medium of claim 1 , wherein the first delta file or the first controller includes code configured to link the first delta file to current software on the first controller, to form a functional equivalent of the second version of controller software.
12. A computer-implemented method for identifying controller anomalies, the method comprising:
accessing real-time processing activity data of a first controller;
accessing controller data represented by at least one of a model or a map developed through a machine learning or statistical analysis technique;
comparing the real-time processing activity data with the controller data, to identify at least one anomaly in the real-time processing activity of the first controller; and
implementing a control action for the first controller based on the identification of the at least one anomaly, the control action comprising causing the first controller to adjust from executing a first version of controller software to a second version of controller software by using a first delta file corresponding to differences between the first and second versions of controller software, wherein the first delta file is stored on the first controller adjacent to either:
the first version of the controller software; or
a second delta file.
13. The computer-implemented method of claim 12 , wherein the controller data is based on data from a second controller.
14. The computer-implemented method of claim 13 , wherein the data from the second controller comprises real-time processing activity data.
15. The computer-implemented method of claim 13 , wherein the first controller and second controller are parts of separate systems.
16. The computer-implemented method of claim 12 , wherein the controller data is based on historical data from the first controller.
17. The computer-implemented method of claim 12 , wherein the first controller is configured to utilize the first delta file without requiring modification to current software on the first controller.
18. The computer-implemented method of claim 12 , wherein the first controller is configured to utilize the first delta file without requiring modification to current software on the first controller.
19. The computer-implemented method of claim 12 , wherein the first controller is configured to utilize the first delta file without requiring a reboot of the first controller.
20. The computer-implemented method of claim 12 , wherein the first delta file or the first controller includes code configured to link the first delta file to current software on the first controller, to form a functional equivalent of the second version of controller software.