Malicious event detection for autonomous vehicles

Abstract

A system comprises an autonomous vehicle (AV) and a control device operably coupled with the AV. The control device detects a series of events within a threshold period of time, where a number of series of events in the series of events is above a threshold number. The series of events taken in the aggregate within the threshold period of time deviates from a normalcy mode. The normalcy mode comprises events that are expected to the encountered by the AV. The control device determines whether the series of events corresponds to a malicious event, where the malicious event indicates tampering with the AV. In response to determining that the series of events corresponds to the malicious event, the series of events are escalated to be addressed.

1 . A server, comprising:
 a memory configured to store at least one of:
 a series of events experienced by an autonomous vehicle, wherein the series of events occur within a threshold period of time; and 
 information about a normalcy mode that comprises events that are expected to be experienced by the autonomous vehicle; and 
   a processor operably coupled to the memory, and configured to:
 receive the series of events from the autonomous vehicle; 
 determine whether the series of events taken as aggregate deviate from the normalcy mode; and 
 in response to determining that the series of events in the aggregate deviate from the normalcy mode, perform at least one countermeasure action to address the series of events. 
   
     
     
         2 . The system of  claim 1 , wherein:
 the series of events comprises at least one event that is not within a field-of-view of at least one sensor coupled to the autonomous vehicle; and   the field-of-view of the at least one sensor corresponds to a detection zone of the at least one sensor.   
     
     
         3 . The system of  claim 1 , wherein to perform the at least one countermeasure the processor is further configured to establish a communication path between the autonomous vehicle and an operator such that the operator is able to converse, using the established communication path, with entities that are causing the series of events. 
     
     
         4 . The system of  claim 1 , wherein the processor is further configured to generate the normalcy mode based on simulating offline driving conditions for the autonomous vehicle in various road environments, wherein the various road environments comprise at least one of a first road environment where the autonomous vehicle is behind traffic, a second road environment where the autonomous vehicle is approaching a traffic light, or a third road environment where a set of vehicles are driving along a road near the autonomous vehicle. 
     
     
         5 . The system of  claim 1 , wherein the series of events comprises one or more of:
 a first series of events indicating that the autonomous vehicle is forced to deviate from a predetermined routing plan by one or more vehicles such that the autonomous vehicle is forced to re-route or pullover;   a second series of events indicating that the autonomous vehicle is forced to slow down by one or more vehicles where other surrounding vehicles are not slowing down;   a third series of events indicating that the autonomous vehicle is forced to slow down as detected by monitoring a speed of an engine of the autonomous vehicle;   a fourth series of events indicating one or more impacts with the autonomous vehicle by one or more vehicles tampering with the autonomous vehicle;   a fifth series of events indicating unexpected driving behaviors from one or more vehicles comprising invading a threshold distance from the autonomous vehicle;   a sixth series of events indicating a vehicle sensor located on the autonomous vehicle is non-responsive as a result of an impact;   a seventh series of events indicating that the autonomous vehicle is forced to drive over an object on the road as a result of unexpected driving behaviors of one or more vehicles;   an eighth series of events indicating that a scheduled action indicated in a map data unexpectedly not occurred, wherein the scheduled action comprises at least one of scheduling of a traffic light and scheduling of a railroad crossing light; and   a ninth series of events indicating that a field of view of the at least one vehicle sensor is obfuscated.   
     
     
         6 . The system of  claim 1 , wherein determining that the series of events in the aggregate deviate from the normalcy mode is in response to:
 comparing the series of events with the normalcy mode information;   determining whether more than a threshold number of events from the series of events correspond to any of the expected events; and   in response to determining that the series of events does not correspond to any of the expected events, determining that the series of events corresponds to a malicious event.   
     
     
         7 . The system of  claim 1 , wherein determining that the series of events in the aggregate deviate from the normalcy mode is in response to confirming a determination made by a second processor associated with the autonomous vehicle that the series of events corresponds to a malicious event. 
     
     
         8 . The system of  claim 1 , wherein:
 the system further comprises a surveillance sensor associated with the autonomous vehicle wherein the surveillance sensor is hidden from sight;   the surveillance sensor is configured to be activated upon detecting the series of events; and   the surveillance sensor is further configured to record the series of events.   
     
     
         9 . The system of  claim 1 , wherein the processor is further configured to:
 determine that the series of events in the aggregate does not deviate from the normalcy mode; and   in response to determining that the series of events does not deviate from the normalcy mode, update the normalcy mode to include the series of events indicating that the series of events does not correspond to a malicious event.   
     
     
         10 . The system of  claim 3 , wherein the established communication path supports at least one of a voice-based, a message-based, or a visual-based communication. 
     
     
         11 . The system of  claim 3 , wherein the established communication path supports a two-way communication between the autonomous vehicle and the operator. 
     
     
         12 . The system of  claim 1 , wherein the at least one countermeasure action comprises causing the autonomous vehicle to activate a horn at the autonomous vehicle discouraging accomplices causing the series of events. 
     
     
         13 . The system of  claim 1 , wherein the at least one countermeasure action comprises sending a notifying message to law enforcement indicating that the autonomous vehicle is being tampered with at a particular location where the series of events is detected. 
     
     
         14 . The system of  claim 1 , wherein the threshold period of time is determined based at least in part upon the number of events in the series of events such that as the number of events in the series of events increases, the threshold period of time increases. 
     
     
         15 . The system of  claim 1 , wherein the events in the normalcy mode correspond to events expected from at least one of:
 moving objects comprising vehicles and pedestrians; or   static objects comprising road signs and traffic lights.   
     
     
         16 . The system of  claim 1 , wherein the autonomous vehicle comprises a tracker unit and is attached to a trailer. 
     
     
         17 . A method, comprising:
 receiving a series of events experienced by an autonomous vehicle, wherein the series of events occur within a threshold period of time;   storing the series of events in a memory;   determining whether the series of events taken as aggregate deviate from a normalcy mode;   in response to determining that the series of events in the aggregate deviate from the normalcy mode, performing at least one countermeasure action to address the series of events.   
     
     
         18 . The method of  claim 17 , wherein:
 the series of events comprises at least one event that is not within a field-of-view of at least one sensor coupled to the autonomous vehicle; and   the field-of-view of the at least one sensor corresponds to a detection zone of the at least one sensor.   
     
     
         19 . The method of  claim 18 , wherein performing the at least one countermeasure comprises establishing a communication path between the autonomous vehicle and an operator such that the operator is able to converse, using the established communication path, with entities that are causing the series of events. 
     
     
         20 . The method of  claim 18 , wherein determining that the series of events in the aggregate deviate from the normalcy mode is in response to:
 comparing the series of events with information about the normalcy mode information about a normalcy mode, the information about the normalcy mode comprising events that are expected to be experienced by the autonomous vehicle;   determining whether more than a threshold number of events from the series of events correspond to any of the expected events; and   in response to determining that the series of events does not correspond to any of the expected events, determining that the series of events corresponds to a malicious event.