Systems and methods for detecting discrepancies in automobile-network data

摘要

The disclosed computer-implemented method for detecting discrepancies in automobile-network data may include (1) receiving data that indicates at least one attribute of an automobile and that was conveyed via an automobile-network message that was purportedly broadcast over an automobile network of the automobile, (2) receiving additional data that indicates the same attribute of the automobile and that was not conveyed via any automobile-network message that was broadcast over the automobile network, (3) detecting a discrepancy between the data and the additional data, and (4) performing a security action in response to detecting the discrepancy between the data and the additional data. Various other methods, systems, and computer-readable media are also disclosed.

主权项

1. A computer-implemented method for detecting discrepancies in automobile-network data, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:
receiving, via a logging device, data that indicates a first state of at least one attribute of an automobile at a moment in time, wherein:
the data has been conveyed via an automobile-network message that was purportedly broadcast over an automobile network of the automobile; andthe logging device is configured to:
connect to the automobile network via a port of the automobile network; andlog automobile-network messages that:
are broadcast over the automobile network; andconvey states of the attribute of the automobile; receiving, via at least one sensor of a mobile device, additional data that indicates a second state of the same attribute of the automobile at the same moment in time, wherein the mobile device was traveling with the automobile when the automobile-network message was logged by the logging device; detecting a security incident by determining that a difference between the first state and the second state is indicative of the automobile-network message having been falsified; and performing a security action by flagging the data as having been falsified.