Vicone Corporation

Trend Micro Inc.

Chih-Kang Lu

Yi-Ting Chen

Yi-Li Cheng

Zhi-Wei Chen

Sean Yen

Chia-Wen Chan

Lou Ju Chun

Sam Lin

Jay Wang

A connected vehicle has several electronic control units (ECUs). Entities running in different ECUs are constrained in corresponding security boundaries. Messages across security boundaries are transmitted over a connection that is not directly available to entities constrained in security boundaries. Messages across security boundaries between entities are inspected. A message from an entity in one security boundary to another entity in another security boundary is inspected by normalizing a content of the message, and comparing the normalized content to a baseline. A corrective action is performed against the message in response to determining that a difference between the normalized content and the baseline indicates a change that is prohibited by a security policy.

Detection of abnormal operations in connected vehicles

An intrusion detection and prevention system (IDPS) has detection probes and detection hubs that are deployed onboard a connected vehicle and a detection correlation backend that is deployed on the cloud. A detection probe receives raw packets of network traffic of a communication network of the connected vehicle. The detection probe filters the raw packets in accordance with packet filter rule entries to generate packets of interest. The detection probe scans the packets of interest for data indicative of network threats and outputs corresponding unfiltered detection logs. The detection probe filters the unfiltered detection logs in accordance with detection filter rule entries to generate detection logs of interest. A detection hub aggregates detection logs of interest from one or more detection probes to generate aggregated detection logs. A detection correlation backend evaluates the aggregated detection logs to detect network threats.

Adaptive network threat detection in distributed automotive execution environments of connected vehicles

A client computer may be configured to perform computer security operation services, such as malicious code scanning and protection against online threats, using one of several remotely located server computers. The client computer may be configured to determine an operational state of the server computers and determine a protection status of the client computer resulting from use of a server computer of a particular operational state. The protection status may have one of at least three levels and indicate vulnerability of the client computer. The client computer may determine the operational state of a server computer based on available bandwidth for network communication between the client computer and the server computer. The client computer may be configured to allow for automatic or manual selection of another server computer when the currently selected server computer results in the client computer having a protection status below a threshold level.

Selection of remotely located servers for computer security operations

Growing community of inventors

Taipei, Taiwan

Chih-Kang Lu