Patent Description:
"<NPL>, describes the radar range equation of radar theory. One form of the basic radar range equation is to determine a signal-to-noise ratio, SNR. Determining radar detection range is introduced using the basic radar range equation.

"<NPL>, also discloses the basic radar range equation. Furthermore, it describes the difference between radar propagation loss (<NUM>-way path loss) and radio communications range loss (<NUM>-way path loss) with respect to a range R and mentions the fact that a radar detector to detect a radar has to pick up the signal on the direct (<NUM>-2ay) path with loss proportion to <NUM>/R<NUM>. <CIT> discloses a method and a laser transceiver device for intruder detection, in which, if an SNR of a received signal for a signal transmitted from another laser transceiver is below a preset threshold, it is determined that an intruder is present.

The dependent claims define the advantageous embodiments thereof.

Various embodiments of the present disclosure provide for identifying "ghosts" detected as valid objects by a radar system. For example, in the case of a vehicle, the present disclosure provides to identify false detections or detections resulting from a malicious attempt to cause the radar system to detect an object where no object exists.

In the following description, numerous specific details such as processor and system configurations are set forth in order to provide a more thorough understanding of the described embodiments. However, the described embodiments may be practiced without such specific details. Additionally, some well-known structures, circuits, and the like have not been shown in detail, to avoid unnecessarily obscuring the described embodiments.

<FIG> depict an environment <NUM>, in accordance with non-limiting example(s) of the present disclosure. The environment <NUM> includes a roadway <NUM> upon which vehicles can travel. For example, vehicles <NUM> and <NUM> are depicted. It is noted that a car is depicted in this and other figures herein. However, this is done for purposes of convenience and not to be limiting. That is, vehicles <NUM> and/or <NUM> could be another type of machine such as, a motorcycle, an airplane, a boat, or the like.

Vehicles <NUM> and <NUM> include a range sensing system (e.g., refer to <FIG>) arranged to identify objects (e.g., other vehicles, humans, stationary objects, etc.) and/or determine range to the object(s). In a most basic system, vehicle <NUM> can be arranged to detect objects in front of vehicle <NUM> and determine whether the object is within a threshold distance based on signal <NUM> and reflection <NUM>. In a more advanced system, vehicle <NUM> can be arranged to detect a number of objects adjacent to (e.g., in front, to the side, behind, etc.) vehicle <NUM> can determine a distance to the detected objects based on signal <NUM> and reflection <NUM>.

Such range sensing systems are susceptible to malicious attacks. For example, <FIG> depicts vehicle <NUM> as victim vehicle <NUM> and vehicle <NUM> and attacker vehicle <NUM>. During a malicious attack, attacker vehicle <NUM> can transmit an attacker signal <NUM>, which can cause victim vehicle <NUM> to detect a ghost vehicle <NUM> based on signal <NUM> and attacker signal <NUM>. Victim vehicle <NUM> may also detect attacker vehicle <NUM> based on signal <NUM> and reflection <NUM>. In particular, attacker vehicle <NUM> can transmit attacker signal <NUM> based on mimicking, or spoofing, the waveform of signal <NUM> in order to induce detection of ghost vehicle <NUM>. Furthermore, attacker vehicle <NUM> can control the time offset of attacker signal <NUM> in order to affect the range or distance with which victim vehicle <NUM> detects ghost vehicle <NUM>.

The present disclosure provides a system (e.g., refer to <FIG>), which can be implemented by a vehicle, such as victim vehicle <NUM>, in order to distinguish actual targets (e.g., attacker vehicle <NUM>) from ghost targets (e.g., ghost vehicle <NUM>).

<FIG> illustrates an example vehicle system <NUM>, in accordance with non-limiting example(s) of the present disclosure. In general, system <NUM> can be implemented in any device where range sensing systems are used and can be implemented to provide the ghost target detection features disclosed herein. System <NUM> includes a number of electronic control units (ECUs), for example, ECU <NUM>, ECU <NUM>, and ECU <NUM>, a SNR consistency monitor <NUM>. ECU <NUM>, ECU <NUM>, and ECU <NUM> are coupled to SNR consistency monitor <NUM> via a communication bus <NUM>. Communication bus <NUM> can be an in-vehicle network (IVN), such as, a Controller Area Network (CAN) bus, a FlexRay bus, a CAN FD bus, an automotive ethernet bus, or a local interconnected network (LIN) bus. Additionally, where implemented in contexts outside of the automotive space, the communication bus <NUM> can be a network bus adapted to the particular implementation, such as, for example, a communication network for manufacturing equipment, or the like.

In general, each of ECU <NUM>, ECU <NUM>, and ECU <NUM> include circuitry arranged to generate messages and transmit the messages onto communication bus <NUM> and/or consume messages from communication bus <NUM>. The depicted ECUs (e.g., ECU <NUM>, ECU <NUM>, and ECU <NUM>) can be any of a variety of devices, such as, for example, sensor devices, actuator devices, microprocessor control devices, or the like. As a specific example, ones of the ECUs <NUM>, <NUM>, and <NUM> can be a collision avoidance ECU, an automated braking ECU, a steering angle ECU, a heating and cooling ECU, an engine management ECU, or the like. At least one of the ECUs will be a radar ECU. For example, ECU <NUM> is depicted as a radar ECU. In general, radar ECU <NUM> can be coupled to hardware (e.g., circuitry, antennas, etc.) and arranged to transmit and receive radar signals (e.g., signal <NUM>, reflection <NUM>, attacker signal <NUM>, or the like).

In general, signal-to-noise (SNR) consistency monitor <NUM> is arranged to distinguish ghost targets from legitimate targets outside the radar sensing pipeline. Said differently, SNR consistency monitor <NUM> is radar technology agnostic. As such, system <NUM> can be implemented in a variety of vehicles independent of the radar sensing technology utilized by the vehicle. With some examples, system <NUM>, or rather SNR consistency monitor <NUM>, can be implemented in an intrusion detection system (IDS) of a vehicle.

SNR consistency monitor <NUM> includes memory <NUM> and processing circuitry <NUM>. Memory <NUM> includes instructions <NUM> (e.g., firmware, or the like) that can be executed by processing circuitry <NUM> as well as Transmitter (Tx) power pattern <NUM>. In general, processing circuitry <NUM> can execute instructions <NUM> to distinguish an actual target (e.g., attacker vehicle <NUM>) from a ghost target (e.g., ghost vehicle <NUM>, or the like) based on the signal to noise ratio (SNR) of the radar signals as well as the range to the targets, which can be collected while the Tx power of the radar signals is varied according to Tx power pattern <NUM>. To that end, memory <NUM> includes target SNRs 220a, 220b, and 220c and target ranges 222a, 222b, and 222c. During operation, processing circuitry <NUM> can execute instructions <NUM> to generate Tx power pattern <NUM> (e.g., from a random sequence, or the like). Further, processing circuitry <NUM> can execute instructions <NUM> to cause the transmit (Tx) power of radar the radar subsystem (e.g., ECU <NUM> and associated circuitry and antennas (not shown) arranged to emit signals like signal <NUM>) to vary based on Tx power pattern <NUM>. Further still, processing circuitry <NUM> can execute instructions <NUM> to receive an indication of target SNRs 220a, 220b, and 220c from the radar subsystem as well as receiving an indication of the target ranges 222a, 222b, and 222c.

In general, processing circuitry <NUM> can execute instructions <NUM> to distinguish an actual target (e.g., attacker vehicle <NUM>) from a ghost target (e.g., ghost vehicle <NUM>, or the like) based on a ration of the received SNRs (e.g., target SNRs 220a, 220b, 220c) over the range (e.g., target ranges 222a, 222b, and 222c). This is explained in greater detail below. However, in general, the present disclosure distinguishes ghost targets from actual targets as the SNR/R associated with the ghost targets is a function of the Tx power of the attacker vehicle <NUM> whereas the SNR-R of legitimate targets is a function of the Tx power of the victim vehicle <NUM>. Accordingly, processing circuitry <NUM> executes instructions <NUM> to determine whether the SNR-R follows a pattern based on Tx power pattern <NUM> to distinguish ghost targets from legitimate targets.

Memory <NUM> can be based on any of a wide variety of information storage technologies. For example, memory <NUM> can be based on volatile technologies requiring the uninterrupted provision of electric power or non-volatile technologies that do not require and possibly including technologies entailing the use of machine-readable storage media that may or may not be removable. Thus, each of these storages may include any of a wide variety of types (or combination of types) of storage devices, including without limitation, read-only memory (ROM), random-access memory (RAM), dynamic RAM (DRAM), Double-Data-Rate DRAM (DDR-DRAM), synchronous DRAM (SDRAM), static RAM (SRAM), programmable ROM (PROM), erasable programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), flash memory, polymer memory (e.g., ferroelectric polymer memory), ovonic memory, phase change or ferroelectric memory, silicon-oxide-nitride-oxide-silicon (SONOS) memory, magnetic or optical cards, one or more individual ferromagnetic disk drives, or a plurality of storage devices organized into one or more arrays (e.g., multiple ferromagnetic disk drives organized into a Redundant Array of Independent Disks array, or RAID array). Additionally, memory <NUM> can include storage devices.

Processing circuitry <NUM> can include any of a variety of processors, such as, for example, commercial central processing units, application specific integrated circuits, or the like. Processing circuitry <NUM> can be a microprocessor or a commercial processor and can include one or multiple processing core(s) and can also include cache.

<FIG> depicts a routine <NUM>, in accordance with non-limiting example(s) of the present disclosure. The routines and logic flows described herein, including routine <NUM>, and other logic flows or routines described herein, are representative of exemplary methodologies for performing novel aspects of the disclosed architecture. While, for purposes of simplicity of explanation, the one or more methodologies shown herein, for example, in the form of a flow chart or flow diagram, are shown and described as a series of acts, it is to be understood and appreciated that the methodologies are not limited by the order of acts, as some acts may, in accordance therewith, occur in a different order and/or concurrently with other acts from that shown and described herein. For example, those skilled in the art will understand and appreciate that a methodology could alternatively be represented as a series of interrelated states or events, such as in a state diagram. Moreover, not all acts illustrated in a methodology may be required for a novel implementation.

Routine <NUM> can be implemented by an intrusion detection system (IDS) or other system arranged to distinguish ghost targets from real targets based on the SNR of the radar signals. For example, routine <NUM> can be implemented by SNR consistency monitor <NUM> of system <NUM>, which itself can be implemented in a vehicle (e.g., victim vehicle <NUM>, or the like). Routine <NUM> can begin at block <NUM> "generate a random sequence (r)" where an IDS can generate a random sequence (r). For example, processing circuitry <NUM> can execute instructions <NUM> to generate a random sequence. Hardware artifacts are used to generate r. For example, processing circuitry <NUM> can execute instructions <NUM> to generate r based on thermal noise in components of the radar subsystem (e.g., ECU <NUM>, radar PHY circuitry, radar antenna circuitry, or the like). As a further example, an amplifier or analog to digital (AD) converter could be employed to convert the physical phenomena to digital sequence r.

Continuing to block <NUM> "generate a Tx power pattern based on r" where an IDS can generate a Tx power pattern based on the sequence r. For example, processing circuitry <NUM> can execute instructions <NUM> to generate Tx power pattern <NUM> from r. As a specific example, Tx power may have an upper and lower bound. Said differently, signal noise floor may limit the lower practical power within which the radar subsystem can transmit. As such, processing circuitry <NUM> can execute instructions <NUM> to generate Tx power pattern <NUM> based on r and upper and/or lower bounds of the Tx power.

Continuing to block <NUM> "send control signals to radar subsystem to cause radar signals to be generated with Tx power based on the Tx power pattern" where the IDS can send control signals to the radar subsystem to cause the radar subsystem to transmit radar signals (e.g., signal <NUM>, or the like) with Tx power based on the Tx power pattern generated at block <NUM>. For example, processing circuitry <NUM> can execute instructions <NUM> to send control signals to radar ECU <NUM> to cause radar ECU <NUM> to transmit signal <NUM> with Tx power based on Tx power pattern <NUM>.

Continuing to block <NUM> "collect SNRs and ranges for targets while Tx power is varied" where the IDS can collect SNRs and ranges for targets over a period of time in which the Tx power is varied. For example, processing circuitry <NUM> can execute instructions <NUM> to receive indications of SNRs and ranges and store the indications as target SNRs 220a, 220b, and 220c and target ranges 222a, 222b, and 222c in memory <NUM>.

Continuing to decision block <NUM> "does SNR-R for one of the targets deviate from the expected SNR/R based on the Tx power pattern?" the IDS can determine whether the SNR-R for any one (or more) of the targets deviates from the expected SNR-R based on the Tx power pattern. For example, processing circuitry <NUM> can execute instructions <NUM> to determine whether the pattern represented by the SNR-R (e.g., target SNR 220a-target range 222a, or the like) deviates from the expected pattern given Tx power pattern <NUM>. In particular, true target power at an ego receiver (e.g., victim vehicle <NUM>, or the like) is a function of two-way propagation and can be represented by the following equation:
<MAT>
while ghost target power at the ego receiver (e.g., victim vehicle <NUM>, or the like) is a function of one-way propagation and can be represented by the following equation:
<MAT>
where given identical Tx parameters (PTXepo = PTXattacker, GTXego - GTXattacker), P is power, G is gain, RX is receive, TX is transmit, R is range, λ is the wavelength, and σ is the radar cross section (e.g., <NUM> dBsm where the attacker is a car).

Given the above equations, processing circuitry <NUM> can execute instructions <NUM> to determine the SNR at range (R) for a true target based on the following equation:
<MAT>
while the SNR at range (R) for a ghost target can be derived based on the following equation:
<MAT>
where average noise power PN is given by the following equation: PN = kTsBnFnL, where k is Boltzmann's constant, B is bandwidth.

With some examples, processing circuitry <NUM> can execute instructions <NUM> to plot the SNR at R for each target and identify ghost targets are targets associated with curves that do not follow the true target pattern. For example, <FIG> illustrates a plot <NUM> showing a number of curves depicting the SNR v R for radar signals received at a receiver (e.g., receiver of victim vehicle <NUM>, or the like). Ghost target curves <NUM> can be distinguished from legitimate target curves <NUM> as the patterns associated with the curves do not follow each other. In particular, the host target pattern <NUM> associated with the ghost target curves <NUM> does not track the Tx power pattern <NUM> associated with the legitimate target curves <NUM>.

From decision block <NUM>, routine <NUM> can continue to block <NUM> or return to block <NUM>. In particular, routine <NUM> can continue to block <NUM> from decision block <NUM> based on a determination at decision block <NUM> that the SNR-R for one of the targets deviates from the expected SNR-R based on the Tx power pattern while routine <NUM> can return to block <NUM> from decision block <NUM> based on a determination at decision block <NUM> that the SNR-R for one of the targets does not deviate from the expected SNR-R based on the Tx power pattern.

At block <NUM> "tag the one of the targets as a ghost target" the IDS can tag the one of the targets with an SNR-R that deviates from the expected SNR-R as a potential ghost target. For example, processing circuitry <NUM> can execute instructions <NUM> to tag the target who it is determined has an SNR/R that deviates from the expected SNR-R at decision block <NUM> as a potential ghost target.

<FIG> illustrates a plot <NUM> showing legitimate target curves <NUM> and ghost target curves <NUM> as well as Tx power pattern <NUM>. As depicted legitimate target curves <NUM> and ghost target curves <NUM> show SNR in decibels (dB) on the Y axis and Range in meters (m) on the X axis.

<FIG> illustrates an example of a storage device <NUM>. Storage device <NUM> may comprise an article of manufacture, such as, any non-transitory computer readable medium or machine readable medium, such as an optical, magnetic or semiconductor storage. Storage device <NUM> may store various types of computer executable instructions <NUM>, such as instructions to implement routine <NUM>. Examples of a computer readable or machine readable storage medium may include any tangible media capable of storing electronic data, including volatile memory or non-volatile memory, removable or non-removable memory, erasable or non-erasable memory, writeable or re-writeable memory, and so forth. Examples of computer executable instructions may include any suitable type of code, such as source code, compiled code, interpreted code, executable code, static code, dynamic code, object-oriented code, visual code, and the like. The examples are not limited in this context.

<FIG> illustrates an embodiment of a system <NUM>. System <NUM> is a computer system with multiple processor cores such as a distributed computing system, supercomputer, high-performance computing system, computing cluster, mainframe computer, mini-computer, client-server system, personal computer (PC), workstation, server, portable computer, laptop computer, tablet computer, handheld device such as a personal digital assistant (PDA), or other device for processing, displaying, or transmitting information. Similar embodiments may comprise, e.g., entertainment devices such as a portable music player or a portable video player, a smart phone or other cellular phone, a telephone, a digital video camera, a digital still camera, an external storage device, or the like. Further embodiments implement larger scale server configurations. In other embodiments, the system <NUM> may have a single processor with one core or more than one processor. Note that the term "processor" refers to a processor with a single core or a processor package with multiple processor cores. In at least one embodiment, the computing system <NUM> is representative of the components of the victim vehicle <NUM>, system <NUM>, and/or SNR consistency monitor <NUM>. More generally, the computing system <NUM> is configured to implement all logic, systems, logic flows, methods, apparatuses, and functionality described herein. As a specific example, system <NUM> can be implemented as part of intrusion detection system and arranged to implement the feature of distinguishing a ghost from an actual target as described herein.

As used in this application, the terms "system" and "component" and "module" are intended to refer to a computer-related entity, either hardware, a combination of hardware and software, software, or software in execution, examples of which are provided by the exemplary system <NUM>. For example, a component can be, but is not limited to being, a process running on a processor, a processor, a hard disk drive, multiple storage drives (of optical and/or magnetic storage medium), an object, an executable, a thread of execution, a program, and/or a computer. By way of illustration, both an application running on a server and the server can be a component. One or more components can reside within a process and/or thread of execution, and a component can be localized on one computer and/or distributed between two or more computers. Further, components may be communicatively coupled to each other by various types of communications media to coordinate operations. The coordination may involve the uni-directional or bi-directional exchange of information. For instance, the components may communicate information in the form of signals communicated over the communications media. The information can be implemented as signals allocated to various signal lines. In such allocations, each message is a signal. Further embodiments, however, may alternatively employ data messages. Such data messages may be sent across various connections. Exemplary connections include parallel interfaces, serial interfaces, and bus interfaces.

As shown in this figure, system <NUM> comprises a motherboard or system-on-chip (SoC) <NUM> for mounting platform components. Motherboard or system-on-chip (SoC) <NUM> is a point-to-point (P2P) interconnect platform that includes a first processor <NUM> and a second processor <NUM> coupled via a point-to-point interconnect <NUM> such as an Ultra Path Interconnect (UPI). In other embodiments, the system <NUM> may be of another bus architecture, such as a multi-drop bus. Furthermore, each of processor <NUM> and processor <NUM> may be processor packages with multiple processor cores including core(s) <NUM> and core(s) <NUM>, respectively. While the system <NUM> is an example of a two-socket (<NUM>) platform, other embodiments may include more than two sockets or one socket. For example, some embodiments may include a four-socket (<NUM>) platform or an eight-socket (<NUM>) platform. Each socket is a mount for a processor and may have a socket identifier. Note that the term platform refers to the motherboard with certain components mounted such as the processor <NUM> and chipset <NUM>. Some platforms may include additional components and some platforms may include sockets to mount the processors and/or the chipset. Furthermore, some platforms may not have sockets (e.g. SoC, or the like).

The processor <NUM> and processor <NUM> can be any of various commercially available processors, including without limitation an Intel® Celeron®, Core®, Core (<NUM>) Duo®, Itanium®, Pentium®, Xeon®, and XScale® processors; AMD® Athlon®, Duron® and Opteron® processors; ARM® application, embedded and secure processors; IBM® and Motorola® DragonBall® and PowerPC® processors; IBM and Sony® Cell processors; and similar processors. Dual microprocessors, multi-core processors, and other multi processor architectures may also be employed as the processor <NUM> and/or processor <NUM>. Additionally, the processor <NUM> need not be identical to processor <NUM>.

Processor <NUM> includes registers <NUM>, integrated memory controller (IMC) <NUM> and point-to-point (P2P) interface <NUM> and P2P interface <NUM>. Similarly, the processor <NUM> includes registers <NUM>, IMC <NUM> as well as P2P interface <NUM> and P2P interface <NUM>. IMC <NUM> and IMC <NUM> couple the processors processor <NUM> and processor <NUM>, respectively, to respective memories (e.g., memory <NUM> and memory <NUM>). Memory <NUM> and memory <NUM> may be portions of the main memory (e.g., a dynamic random-access memory (DRAM)) for the platform such as double data rate type <NUM> (DDR3) or type <NUM> (DDR4) synchronous DRAM.

In the present embodiment, the memories memory <NUM> and memory <NUM> locally attach to the respective processors (i.e., processor <NUM> and processor <NUM>). In other embodiments, the main memory may couple with the processors via a bus and shared memory hub.

System <NUM> includes chipset <NUM> coupled to processor <NUM> and processor <NUM>. Furthermore, chipset <NUM> can be coupled to storage device <NUM>, for example, via an interface (I/F) <NUM>. The I/F <NUM> may be, for example, a Peripheral Component Interconnect-enhanced (PCI-e).

Processor <NUM> couples to a chipset <NUM> via P2P interface <NUM> and P2P <NUM> while processor <NUM> couples to a chipset <NUM> via P2P interface <NUM> and P2P <NUM>. Direct media interface (DMI) <NUM> and DMI <NUM> may couple the P2P interface <NUM> and the P2P <NUM> and the P2P interface <NUM> and P2P <NUM>, respectively. DMI <NUM> and DMI <NUM> may be a highspeed interconnect that facilitates, e.g., eight Giga Transfers per second (GT/s) such as DMI <NUM>. In other embodiments, the processor <NUM> and processor <NUM> may interconnect via a bus.

The chipset <NUM> may comprise a controller hub such as a platform controller hub (PCH). The chipset <NUM> may include a system clock to perform clocking functions and include interfaces for an I/O bus such as a universal serial bus (USB), peripheral component interconnects (PCIs), serial peripheral interconnects (SPIs), integrated interconnects (12Cs), and the like, to facilitate connection of peripheral devices on the platform. In other embodiments, the chipset <NUM> may comprise more than one controller hub such as a chipset with a memory controller hub, a graphics controller hub, and an input/output (I/O) controller hub.

In the depicted example, chipset <NUM> couples with a trusted platform module (TPM) <NUM> and UEFI, BIOS, FLASH circuitry <NUM> via I/F <NUM>. The TPM <NUM> is a dedicated microcontroller designed to secure hardware by integrating cryptographic keys into devices. The UEFI, BIOS, FLASH circuitry <NUM> may provide pre-boot code.

Furthermore, chipset <NUM> includes the I/F <NUM> to couple chipset <NUM> with a high-performance graphics engine, such as, graphics processing circuitry or a graphics processing unit (GPU) <NUM>. In other embodiments, the system <NUM> may include a flexible display interface (FDI) (not shown) between the processor <NUM> and/or the processor <NUM> and the chipset <NUM>. The FDI interconnects a graphics processor core in one or more of processor <NUM> and/or processor <NUM> with the chipset <NUM>. Additionally, ML accelerator <NUM> coupled to chipset <NUM> via I/F <NUM>. ML accelerator <NUM> can be circuitry arranged to execute ML related operations (e.g., training, inference, etc.) for ML models. In particular, ML accelerator <NUM> can be arranged to execute mathematical operations and/or operands useful for machine learning.

Various I/O devices <NUM> and display <NUM> couple to the bus <NUM>, along with a bus bridge <NUM> which couples the bus <NUM> to a second bus <NUM> and an I/F <NUM> that connects the bus <NUM> with the chipset <NUM>. In one embodiment, the second bus <NUM> may be a low pin count (LPC) bus. Various devices may couple to the second bus <NUM> including, for example, a keyboard <NUM>, a mouse <NUM> and communication devices <NUM>.

Furthermore, an audio I/O <NUM> may couple to second bus <NUM>. Many of the I/O devices <NUM> and communication devices <NUM> may reside on the motherboard or system-on-chip(SoC) <NUM> while the keyboard <NUM> and the mouse <NUM> may be add-on peripherals. In other embodiments, some or all the I/O devices <NUM> and communication devices <NUM> are add-on peripherals and do not reside on the motherboard or system-on-chip(SoC) <NUM>.

<FIG> illustrates an in-vehicle communication architecture <NUM> according to one or more embodiments of the disclosure. For example, one or more vehicular devices, components, or circuits, such as circuitry <NUM> and/or circuitry <NUM>, may communicate with each other via a communication framework <NUM>, which may be an in-vehicle network, such as a CAN bus, implemented to facilitate the context based attacking mitigation techniques described herein.

The in-vehicle communication architecture <NUM> includes various common communications elements, such as a transmitter, receiver, transceiver, and so forth. The embodiments, however, are not limited to implementation by the in-vehicle communication architecture <NUM>. As shown in this figure, the vehicular circuitry <NUM> and circuitry <NUM> may each be operatively connected to one or more respective data devices, such as, data device <NUM> and/or data device <NUM> that can be employed to store information local to the respective circuitry <NUM> and/or circuitry <NUM>, such as radar signals, trajectories, velocities, ranges, or the like. It may be understood that the circuitry <NUM> and circuitry <NUM> may be any suitable vehicular component, such as sensor, an ECU, microcontroller, microprocessor, processor, ASIC, field programmable gate array (FPGA), any electronic device, computing device, or the like. Moreover, it may be understood that one or more computing devices (containing at least a processor, memory, interfaces, etc.) may be connected to the communication framework <NUM> in a vehicle.

Further, the communication framework <NUM> may implement any well-known communications techniques and protocols. As described above, the communication framework <NUM> may be implemented as a CAN bus protocol or any other suitable in-vehicle communication protocol. The communication framework <NUM> may also implement various network interfaces arranged to accept, communicate, and connect to one or more external communications networks (e.g., Internet). A network interface may be regarded as a specialized form of an input/output (I/O) interface. Network interfaces may employ connection protocols including without limitation direct connect, Ethernet (e.g., thick, thin, twisted pair <NUM>/<NUM>/<NUM> Base T, and the like), token ring, wireless network interfaces, cellular network interfaces, IEEE <NUM>. 7a-x network interfaces, IEEE <NUM> network interfaces, IEEE <NUM> network interfaces, and the like. Further, multiple network interfaces may be used to engage with various communications network types. The communication framework <NUM> may employ both wired and wireless connections.

Claim 1:
An apparatus for intrusion detection, comprising:
means for generating (<NUM>) a random sequence based in part on random physical hardware artifacts;
means for generating (<NUM>) a transmit, Tx power pattern (<NUM>, <NUM>) by an intrusion detection system of a vehicle (<NUM>) based on the random sequence;
means for sending (<NUM>) one or more control signals to a radar transmitter to cause the radar transmitter to transmit a radar signal (<NUM>) based on the Tx power pattern;
means for receiving at least one radar signal at a radar receiver;
means for identifying a signal to noise ratio, SNR, and a range associated with the at least one radar signal (<NUM>);
means for determining (<NUM>) whether the SNR and range of the at least one radar signal deviates from an expected SNR and range based on the Tx power pattern; and
means for tagging (<NUM>) a target associated with the at least one radar signal as a ghost target based on a determination that the SNR and range of the at least one radar signal deviates from the expected SNR and range based on the Tx power pattern.