Detecting anomalies using real-time controller processing activity

Abstract

Disclosed embodiments relate to performing updates to Electronic Control Unit (ECU) software while an ECU of a vehicle is operating. Operations may include receiving, at the vehicle while the ECU of the vehicle is operating, a software update file for the ECU software; writing, while the ECU is operating, the software update file into a first memory location in a memory of the ECU while simultaneously executing a code segment of existing code in a second memory location in the memory of the ECU; and updating a plurality of memory addresses associated with the memory of the ECU based on the software update file and without interrupting the execution of the code segment currently being executed in the second memory location in the memory of the ECU.

1 - 20 . (canceled) 
     
     
         21 . A non-transitory computer-readable medium including instructions that, when executed by at least one processor, cause the at least one processor to perform operations for identifying controller anomalies, comprising:
 receiving first data based on real-time operation activity of a controller;   receiving second data based on historical operation activity of at least one other controller;   comparing the first data with the second data to identify, based on a deviation between the first data and the second data, at least one anomaly associated with the real-time operation activity of the controller; and   based on identifying the at least one anomaly based on the deviation, adjusting, using a delta file, the controller from being configured to execute a first version of controller software to being configured to execute a second version of controller software.   
     
     
         22 . The non-transitory computer-readable medium of  claim 21 , wherein comparing the first data with the second data comprises using a statistical model generated based on time-based analysis of at least one runtime attribute of the at least one other controller, 
     
     
         23 . The non-transitory computer-readable medium of  claim 21 , the operations further comprising configuring the first version of controller software to be non-executable. 
     
     
         24 . The non-transitory computer-readable medium of  claim 21 , wherein the delta file comprises position-independent code. 
     
     
         25 . The non-transitory computer-readable medium of  claim 21 , wherein the controller and the at least one other controller are comparable based on at least one of:
 respective control functions of the controller and the at least one other controller; or   respective rules of the controller and the at least one other controller.   
     
     
         26 . The non-transitory computer-readable medium of  claim 21 , wherein the real-time operation activity of the controller corresponds to actual operation of the controller in a system. 
     
     
         27 . The non-transitory computer-readable medium of  claim 21 , wherein the at least one anomaly corresponds to at least one of: a memory location accessed by the controller, a sequence of memory locations accessed by the controller, an anomalous data flow to or from the controller, anomalous data processing behavior by the controller, or an anomalous power consumption behavior of the controller. 
     
     
         28 . The non-transitory computer-readable medium of  claim 21 , wherein the second data is selected based on at least one of: at least one known valid sequence of execution of software on the controller, at least one known potentially malicious sequence of execution of software on the controller, or a map file associated with software on the controller. 
     
     
         29 . The non-transitory computer-readable medium of  claim 21 , wherein the comparing uses a machine learning technique to identify the at least one anomaly. 
     
     
         30 . The non-transitory computer-readable medium of  claim 21 , wherein the delta file comprises startup code configured to at least:
 initialize a runtime library of the delta file;   update a program counter of the controller; or   update memory addresses of the controller.   
     
     
         31 . The non-transitory computer-readable medium of  claim 21 , wherein the second data includes data obtained in real-time relating to processing activity of the at least one other controller. 
     
     
         32 . The non-transitory computer-readable medium of  claim 21 , the operations further comprising sending an alert associated with the controller. 
     
     
         33 . The non-transitory computer-readable medium of  claim 21 , the operations further comprising blocking an instruction sent from the controller. 
     
     
         34 . A computer-implemented method for identifying controller anomalies, the method comprising:
 receiving first data based on real-time operation activity of a controller;   receiving second data based on historical operation activity of at least one other controller;   comparing the first data with the second data to identify, based on a deviation between the first data and the second data, at least one anomaly associated with the real-time operation activity of the controller; and   based on identifying the at least one anomaly based on the deviation, adjusting, using a delta file, the controller from being configured to execute a first version of controller software to being configured to execute a second version of controller software.   
     
     
         35 . The computer-implemented method of  claim 34 , wherein comparing the first data with the second data comprises using a statistical model generated based on time-based analysis of at least one runtime attribute of the at least one other controller. 
     
     
         36 . The computer-implemented method of  claim 34 , further comprising configuring the first version of controller software to be non-executable. 
     
     
         37 . The computer-implemented method of  claim 34 , wherein the real-time operation activity of the controller corresponds to actual operation of the controller in a system. 
     
     
         38 . The computer-implemented method of  claim 34 , wherein the at least one anomaly corresponds to at least one of: a memory location accessed by the controller, a sequence of memory locations accessed by the controller, an anomalous data flow to or from the controller, anomalous data processing behavior by the controller, or an anomalous power consumption behavior of the controller. 
     
     
         39 . The computer-implemented method of  claim 34 , wherein the second data is selected based on at least one of: at least one known valid sequence of execution of the software, at least one known potentially malicious sequence of execution of the software, or a map file associated with the software. 
     
     
         40 . The computer-implemented method of  claim 34 , wherein the second data includes data obtained in real-time relating to processing activity of the at least one other controller.