Patent Description:
The operation of vehicles, for example, ground vehicles (e.g. cars, trucks, motorcycles, trains, etc.), aerial vehicles (e.g. drones), naval vehicles (e.g. unmanned naval vehicles), robots and/or the like has long ago become heavily reliant on automated systems utilizing multiple Electronic Control Units (ECU) deployed in the vehicle to control almost every aspect of the operation of the vehicle. This trend is naturally further intensifies with the evolution of autonomic vehicles where the human factor, i.e. the human driver, is no longer the sole controller of the vehicle which is rather controlled at least partially by the automated and autonomous systems.

The automated and autonomous systems of the vehicle may utilize for their operation a plurality of devices deployed in the vehicle, for example, sensors, Electronic Control Units (ECU), Input/Output (I/O) controllers, communication controllers and/or the like. The plurality of deployed devices may communicate with each by exchanging messages over one or more communication channels deployed in the vehicle, for example, a Controller Area Network (CAN) bus, a Local Interconnect Network (LIN), a FlexRay bus, a Local area Network (LAN), an Ethernet, an automotive Ethernet, a wireless LAN (WLAN, e.g. Wi-Fi), a Wireless CAN (WCAN), a Media Oriented Systems Transport (MOST) and/or the like.

These automated and autonomous systems may transfer large volumes of data, for example, the exchanged messages and/or part thereof to remote (off vehicle) networked resources, for example, remote servers, cloud services and/or the like for a plurality of uses and applications such as, for example, predictive maintenance, anomaly detection, forensics, fleet management and many others.

<CIT> describes a system that includes an on-board unit (OBU) in communication with an internal subsystem in a vehicle on at least one Ethernet network and a node on a wireless network. A method in one embodiment of this Application Publication includes receiving a message on the Ethernet network in the vehicle, encapsulating the message to facilitate translation to Ethernet protocol if the message is not in Ethernet protocol, and transmitting the message in Ethernet protocol to its destination. Certain embodiments in this publication include optimizing data transmission over the wireless network using redundancy caches, dictionaries, object contexts databases, speech templates and protocol header templates, and cross layer optimization of data flow from a receiver to a sender over a TCP connection. Certain embodiments, in this publication, also include dynamically identifying and selecting an operating frequency with least interference for data transmission over the wireless network.

The invention includes a method and a system.

The present invention, in some embodiments thereof, relates to reducing size of messages intercepted in an operational environment of a vehicle, and, more specifically, but not exclusively, to reducing size of messages intercepted in an operational environment of a vehicle by optimizing learned data patterns identified in the messages.

According to some embodiments of the present invention, there are provided methods and systems for reducing a size of one or more messages intercepted while transmitted via one or more communication channels of a vehicle, for example, a ground vehicle, an aerial vehicle, a naval vehicle, a robot and/or the like. The reduced size messages are transmitted from the vehicle to one or more remote (off vehicle) networked resources, for example, a remote server, a cloud service, a cloud platform and/or the like which may further analyze the intercepted messages for one or more applications, for example, predictive maintenance, anomaly detection, forensics, fleet management and many others. Additionally or alternatively, the reduced size messages may be locally stored at the vehicle in order to locally analyze them and/or upload them at a later time to the remote networked resource(s) for further analysis.

One or more monitoring devices are deployed in the vehicle to intercept one or more messages exchanged through one or more communication channels and/or protocols used in the vehicle, for example, a CAN bus, a LIN, a FlexRay, a LAN, an Ethernet, an automotive Ethernet, a WLAN (e.g. Wi-Fi), a WCAN, a MOST and/or the like in order to communicate with one or more devices deployed in the vehicle <NUM>, for example, a sensor, an ECU, a I/O controller, a communication controller and/or the like.

The monitoring device(s) is configured as passive receiver-only device incapable of injecting data to the communication channels. The monitoring device(s) is coupled to the communication channel(s) in an isolated manner thus incapable of inducing, altering, manipulating and/or otherwise affecting the transmission signals of the communication channels in any way.

One or more trained machine learning model(s) is applied to analyze one or more of the intercepted messages in order to identify one or more data patterns in the intercepted message(s). The trained machine learning models, for example, a parametric machine learning model, a non-parametric machine learning model, a supervised machine learning model, an unsupervised machine learning model, a semi-supervised machine learning model and/or the like may utilize one or more machine learning probabilistic models, engines and/or algorithms, for example, a neural network, a support vector machine (SVM), a decision tree, a K-Nearest neighbors algorithm, a context tree, a graphical model, a Bayesian net, a random forest, a rotational forest, a deep learning algorithm and/or any other learning algorithm trained as known in the art.

During the training phase the machine learning model(s) is trained with training datasets comprising training message designed, constructed and/or selected to represent the messages exchanged in the operational environment of the (target) vehicle. The machine learning model(s) is trained to identify, i.e. cluster, classify, map and/or the like one or more data patterns in the intercepted messages. The data patterns learned by the trained machine learning model(s) during a training phase may include, for example, constant values, incrementing values, decrementing values, finite sets and/or ranges of discrete values and/or the like.

The communication channels and/or protocols utilized in the vehicle typically define messages comprising a plurality of fields, for example, a message identifier, an originating device identifier, a destination device identifier, a time stamp, a payload size indicator, a payload, a metadata, a protocol related field and/or the like. The machine learning model(s) is therefore be trained to identify the data patterns in the fields of the intercepted messages.

The intercepted messages are adjusted by replacing the identified data patterns with respective predefined representations having a reduced size compared to the respective data patterns such that the overall size of the intercepted messages is significantly reduced. The predefined representations is lossless such that no data is lost by replacing the original data pattern(s) detected in the message(s) with the predefined reduced size representation(s).

The reduced size representations may be predefined to reduce the size of certain field(s) of the intercepted message(s) according to one or more operational parameters of the vehicle, for example, a type of the devices deployed in the vehicle, a type of the protocols used in the vehicle, a communication capabilities of the vehicle and/or the like. For example, one or more of the protocols used in the vehicle may define large fields (in terms of bits and/or bytes) to allow encoding very large values, for example, message types, device identifiers, status and/or control data codes, sensor reading values and/or the like. However, the operational parameters of each vehicle may naturally include limited and significantly small value set(s) and/or range(s) for these operational parameters. The size of one or more of the fields may therefore be significantly reduced to allow encoding the set(s) and/or range(s) applicable for the vehicle.

For example, a certain protocol may define a large message identifier field to support a large number of message types. However, the number of message types actually used by the devices deployed in the vehicle may be significantly small. The message identifier may therefore be represented by a reduced size representation (having less bits or bytes) which is sufficient for encoding the small number of message types actually used in the vehicle environment. In another example, a certain protocol may define a large payload field to support a wide range of data values. However, the number of data values actually recorded in messages exchanged between the devices deployed in the vehicle may be limited and significantly small compared to the supported range.

Optionally, the reduced size representations of the detected data patterns are mapped in a dataset, for example, a list, a table, a database and/or the like comprising a plurality of entries each associating (indexing) one of the learned data patterns with a respective one of a plurality of predefined reduced size representations. The dataset is available both at the vehicle and to the remote networked resource(s) such that remote networked resource(s) may correctly decode the predefined reduced size representations to restore the respective original data patterns replaced with the predefined reduced size representations. Moreover, the reduced size representations may be indices in the dataset such that each of the reduced size representations points to its respective data pattern which may thus be easily retrieved from the dataset.

Moreover, the time stamp field identified in one or more of the intercepted messages may be very large to support absolute high resolution timing, for example, a date, a day of week, a time including fractions of time (e.g. hours, minutes, seconds, milliseconds, microseconds, nanoseconds, etc.) and/or the like. However, the transmission time of the message over the communication channel of the vehicle may relatively low. As such, the high resolution time stamp expressing, for example, microseconds and/or nanoseconds may be irrelevant and/or of no benefit due to the significantly lower transmission rate. The high resolution elements (e.g. microseconds, nanoseconds, e.g.) may therefore be discarded, removed to provide a reduced size representation of the time stamp.

Furthermore, the absolute time stamp may be replaced with a relative time stamp expressing the time stamp of a current message with respect to the time stamp of one or more previously intercepted messages. For example, the lower resolution absolute timing elements of the time stamp such as the date, day of week, the hour and/or the like may be maintained in an intercepted message once every predefined period, for example, an hour. The next higher absolute resolution timing elements of the time stamp, for example, the minutes count and/or the seconds count may be maintained in an intercepted message once a second. As such the reduced size representation of the relative time stamp adjusted for most of the intercepted messages may include only a relative timing, for example, the milliseconds with respect to the most recently transmitted message which maintains the absolute timing.

The adjusted messages are then be output, specifically stored and/or transmitted to the remote networked resource(s) to further analyze the intercepted messages. As the data patterns detected in the originally intercepted messages are predefined, for example, in the dataset, the remote networked resource(s) having access to the dataset may correlate between the replaced data patterns and their respective reduced size representations. The remote networked resource(s) may therefore be able to recover, for example, restore, reconstruct, decode, extract and/or the like the originally intercepted messages.

Reducing the size of the intercepted messages may present significant advantages and benefits. First, the communication resources, for example, a bandwidth available for transmitting (uploading) data, specifically the intercepted messages from the vehicle to the remote networked resource(s) may be significantly limited. This may lead to a reduction in the ability to upload the intercepted messages, increase latency and/or the like in particular since the amount of intercepted messages may be extremely high. Reducing the size of the intercepted message(s) may significantly reduce the bandwidth required for uploading the intercepted messages since the bandwidth required for transmitting the adjusted messages may be significantly reduced compared to the bandwidth required for transmitting the originally intercepted messages. The adjusted messages may further reduce the latency in the upload process. In addition, in case the intercepted messages are locally stored in the vehicle for further analysis at the vehicle and/or for uploading (transmitting) them to the remote networked resource(s) at a later time, storing the reduced size messages may require significantly reduced storage resources in the vehicle.

Moreover, huge numbers of vehicles may be uploading their intercepted messages to the remote networked resource(s). Storing the intercepted messages received from these vehicles may therefore require extreme storage resources. Reducing the size of the intercepted message(s) may significantly reduce the required storage resources for storing the messages intercepted at the multitude of vehicles.

Furthermore, using the machine leaning model(s) for the pattern detection may be highly superior compared to rule based implementations as may be done by existing systems and/or methods for pattern detection. In contrast to the rule based techniques, the machine leaning model(s) may automatically and constantly evolve to adapt to new message content patterns while avoiding the need to redesign and deploy updated pattern detection rules. Moreover, the machine leaning model(s) may be trained using large volumes of realistic training datasets thus significantly improving the accuracy, efficiency and/or comprehensiveness of the pattern detection.

In addition, since the reduced size representations used to replace the identified data patterns in the intercepted messages are predefined, for example, in the dataset, the remote networked resource(s) having access to the dataset may easily recover the originally intercepted messages for its further analysis.

As will be appreciated by one skilled in the art, aspects of the present invention are embodied as a system and a method. A computer program product is described herein for demonstration purposes and is not part of the claimed invention.

Such a propagated signal may take any of a variety of forms, including, but not limited to, electromagnetic, optical, or any suitable combination thereof.

Computer Program code comprising computer readable program instructions embodied on a computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wire line, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

The program code for carrying out operations for aspects of the present invention may be written in any combination of one or more programming languages, including an object oriented programming language such as Java, Smalltalk, C++ or the like and conventional procedural programming languages, such as the "C" programming language or similar programming languages.

The program code can be downloaded to respective computing/processing devices from a computer readable storage medium or to an external computer or external storage device via a network, for example, the Internet, a local area network, a wide area network and/or a wireless network.

Referring now to the drawings, <FIG> illustrates a flowchart of an exemplary process of reducing a size of intercepted messages, according to some embodiments of the present invention. An exemplary process <NUM> may be executed to reduce a size of one or more messages intercepted while transmitted via one or more communication channels of a vehicle, for example, a ground vehicle, an aerial vehicle, a naval vehicle, a robot and/or the like. One or more trained machine learning models are applied to identify one or more data patterns in the message(s). The identified data patterns are replaced with respective predefined representations which are reduced in size compared to the respective data patterns such that the overall size of the intercepted messages is significantly reduced. The predefined representations are lossless meaning that no data is lost by replacing the original data pattern(s) identified in the message(s) with the predefined reduced size representation(s).

The trained machine learning model(s) for example, parametric supervised algorithms, non-parametric semi-supervised algorithms, non-parametric algorithms and/or the like are trained during a training phase with training datasets comprising training message designed, constructed and/or selected to represent the messages exchanged in the vehicle operational environment.

Reference is also made to <FIG>, which is a schematic illustration of an exemplary system for reducing a size of intercepted messages, according to some embodiments of the present invention. An exemplary optimization system <NUM> may be deployed, for example, installed, mounted, attached and/or integrated in a vehicle <NUM>, for example, a ground vehicle, an aerial vehicle, a naval vehicle, a robot and/or the like in particular a ground vehicle, for example, a car, a truck, a motorcycle, a train and/or the like.

The optimization system <NUM> may include a network interface <NUM> for connecting to a network <NUM>, a processor(s) <NUM> for executing a process such as the process <NUM> and storage <NUM> for storing program code (i.e. program store) and/or data. The network interface <NUM> may include one or more wireless network interfaces for connecting to the network <NUM>, for example, a Radio Frequency (RF) interface, a Wireless Local Area Network (WLAN) interface, a cellular network interface and/or the like. Using the network interface <NUM> for connecting to a network <NUM> comprising one or more wired and/or wireless networks, for example, a LAN, a WLAN, a Wide Area Network (WAN), a Municipal Area Network (MAN), a cellular network, the internet and/or the like, the optimization system <NUM> connects to one or more remote servers <NUM>.

The network interface may further include one or more I/O interfaces for connecting to one or more wired and/or wireless (vehicle) communication channels of the vehicle <NUM>, for example, a CAN bus, a LIN, a FlexRay, a LAN, an Ethernet, an automotive Ethernet, a WLAN (e.g. Wi-Fi), a WCAN, a MOST and/or the like in order to communicate with one or more devices deployed in the vehicle <NUM>, for example, a sensor, an ECU, an I/O controller, a communication controller and/or the like.

The processor(s) <NUM>, homogenous or heterogeneous, may include one or more processing nodes arranged for parallel processing, as clusters and/or as one or more multi core processor(s). The storage <NUM> may include one or more non-transitory memory devices, either persistent nonvolatile devices, for example, a ROM device, a Flash device, a hard drive, a Solid State Drive (SSD), a magnetic disk and/or the like and/or volatile devices, for example, a RAM device, a cache memory and/or the like.

The processor(s) <NUM> executes one or more software modules, for example, a process, a script, an application, an agent, a utility, a tool and/or the like each comprising a plurality of program instructions stored in a non-transitory medium such as the storage <NUM> and executed by one or more processors such as the processor(s) <NUM>. For example, the processor(s) <NUM> may execute a massage optimizer application <NUM> for executing the process <NUM> to reduce the size of one or more of the intercepted messages.

The remote server <NUM>, for example, a storage server, a processing node, a cluster of processing nodes and/or the like may be collect data, for example, messages intercepted in the vehicular operational environment including the reduced size messages from a plurality of optimization systems <NUM> deployed in a plurality of vehicles <NUM>. The remote server <NUM> may further include one or more cloud computing and/or storage services and/or platforms such as, for example, Amazon Web Service (AWS), Google Cloud, Microsoft Azure and/or the like. The collected messages may be used for one or more of a plurality of application, for example, predictive maintenance, anomaly detection, forensics, fleet management and/or the like.

Reference is now made to <FIG>, which is a schematic illustration of an exemplary distributed vehicular system for intercepting communication messages exchanged over communication channels of a vehicle, according to some embodiments of the present invention. An exemplary system <NUM> may deploy in a vehicle such as the vehicle <NUM> for intercepting messages exchanged between a plurality of devices <NUM> deployed in the vehicle <NUM>. The devices <NUM> may include for example, sensor(s), ECU(s), I/O controller(s), communication controller(s) and/or the like. The topology and deployment of the system <NUM> is exemplary and should not be construed as limiting since multiple other deployments, topologies and/or layouts may be implemented as known in the art.

The sensors may include one or more sensors, for example, an engine operation sensor, an environmental condition sensor (e.g. temperature sensor, a light sensor, a humidity sensor, etc.), a navigation sensor (e.g. a Global Positioning System (GPS) sensor, an accelerometer, a gyroscope, etc.), an imaging sensor (e.g. a camera, a night vision camera, a thermal camera, etc.) and/or the like. The ECUs may include one or more processing units and/or controllers adapted to operated, control and/or execute one or more functions of the vehicle <NUM>, for example, steering, accelerating, breaking, parking, information collection, safety system control, multimedia, infotainment, door control, window control and/or the like. The I/O controllers may include one or more controllers adapted to connect to one or more of the sensors, the ECUs and/or the like. The I/O controllers may include one or more controllers adapted to operate one or more user interfaces, for example, a pointing device, a keyboard, a display, an audio interface and/or the like. The communication controllers may include one or more controllers adapted to connect to the network <NUM>. Optionally, one or more of the devices <NUM> may be integrated devices comprising one or more of the sensors, the ECUs, the I/O controllers, the communication controllers and/or the like.

The devices <NUM> may communicate with each other by sending messages over one or more wired and/or wireless (vehicle) communication channels <NUM> deployed in the vehicle <NUM>, for example, CAN bus, LIN, FlexRay, LAN, Ethernet, automotive Ethernet, WLAN (e.g. Wi-Fi), WCAN, MOST and/or the like. The topology of the system may vary and may include a plurality of communication channels <NUM> of various types and various topologies (e.g. bus, point-to-point, multi-drop, etc.) which may be further segmented. By deploying specific types of communication channels <NUM> and optionally segmenting one or more of them, the topology of the system <NUM> may be adapted to accommodate one or more needs, constraints and/or objectives of the system <NUM>, for example, apply segregated domain(s) for increased security to sensitive devices <NUM>, adapt to deployment physical limitation(s) of the vehicle <NUM> (e.g. limited space, long distances, etc.), create a hierarchical structure(s) for at least some of the devices <NUM> and/or the like.

For example, one or more devices <NUM>, for example, a device <NUM> N1, a device <NUM> N2 through device <NUM> Nn may connect to a communication channel 302N, for example, a LIN. In another example, one or more devices <NUM>, for example, a device <NUM> M1, a device <NUM> M2 through device Mm may connect to a segmented communication channel <NUM>, for example, a CAN bus comprising two CAN bus segments 302M1 and 302M2. In another example, one or more devices <NUM>, for example, a device <NUM> L1, a device <NUM> L2 through device <NUM> Ll may connect to a communication channel <NUM>, for example, a MOST. In another example, one or more devices <NUM>, for example, a device <NUM><NUM>, a device <NUM> J2 through a device <NUM> Jj may connect to a communication channel 302J, for example, a Wi-Fi network.

The system <NUM> may further include one or more bridges <NUM> adapted to connect between communication channels <NUM> of different types and/or between segments of one or more of the communication channels <NUM>. The bridges <NUM> may transfer one or more messages from one communication channel <NUM> to another communication channels <NUM> in one or both directions to allow propagation of messages between the communication channels <NUM>. Naturally, each bridge <NUM> includes the appropriate interfaces and/or ports for connecting to the respective communication channels <NUM> it connects to. For example, a bridge <NUM>-N may connect the communication channel 302N and the communication channel <NUM>. In another example, a bridge <NUM> MN-J may connect the communication channels 302N and <NUM> with the communication channels 302J. In another example, a bridge <NUM> may connect between the segments 302M1 and 302M2 of the communication channels <NUM>.

One or more of the devices <NUM> may also serve as a bridge <NUM>. For example, the device <NUM> may bridge between the communication channel <NUM>, specifically the segment 302M2 of the communication channel <NUM> and the communication channel <NUM>. In another example, the device <NUM> J2 may serve as a bridge <NUM> for connecting a device <NUM><NUM>, a device <NUM> J2 and/or a device <NUM> J3 to the communication channel 302J where the device <NUM> J1 connects to the device <NUM> J2 through a communication channel 302J1, the device <NUM> J2 connects to the device <NUM> J2 through a communication channel 302J2 and the device <NUM> J3 connects to the device <NUM> J2 through a communication channel 302J3. The communication channels 302J1, 302J2 and/or 302J2 may be of the same type and/or of different types.

The system <NUM> may further include one or more monitoring devices <NUM> for monitoring and intercepting communication, specifically messages exchanged between the devices <NUM> over the communication channels <NUM>. The monitoring devices <NUM> may be operatively connected to the optimization system <NUM>, for example, via the communication channel(s) <NUM> and/or through dedicated communication channel for transferring the intercepted messages to the optimization system <NUM>.

The system <NUM> may include a central monitor <NUM> which may connect to a plurality of the communication channels <NUM> and monitor the multitude of communication channels <NUM>. However, the system <NUM> may include a plurality of monitors <NUM>, for example, a monitor_1 which monitors the communication channel 302N, a monitor_2 which monitors the communication channel <NUM> specifically the segments 302M1 and 302M2, a monitor_3 which monitors the communication channel <NUM>, a monitor_4 which monitors the communication channel 302J and/or the like. The monitor_4 may further monitor one or more of the communication channels 302J1, 302J2 and/or 302J3. One or more of the monitors <NUM> may be integrated in one or more of the devices <NUM> and/or the bridges <NUM> such that in addition to its normal operation the integrated device <NUM> or the integrated bridge <NUM> may monitor and intercept messages transmitted on the respective communication channel(s) <NUM> it connects to.

According to some embodiments of the present invention, the monitors <NUM> are receive-only devices which are only capable of intercepting (receiving) the messages transmitted on the communication channel(s) <NUM> while unable to transmit messages or affect the communication channel(s) <NUM> in any way.

The monitoring device(s) <NUM> adapted to intercept the messages exchanged over the communication channels <NUM> is configured as passive receiver-only device incapable of injecting data to the communication channels <NUM>. Furthermore the monitoring device(s) <NUM> is coupled to the communication channels <NUM> in an isolated manner thus incapable of inducing, altering, manipulating and/or otherwise affecting the transmission signals of the communication channels <NUM> in any way. For example, one or more of the monitoring devices <NUM> may include one or more sensing wires wrapped around one or more insulated wires of one or more of the communication channels <NUM> such that the sensing wire(s) are incapable of injecting data, messages and/or signals to the communication channel(s) <NUM>. By analyzing the electric load, current and/or voltage of the signals travelling (propagating) through the insulated wires of the communication channel(s) <NUM> as sensed by the sensing wire(s), the monitoring device(s) <NUM> may detect messages exchanged over the communication channel(s) <NUM> and intercept them. In another example, one or more of the monitoring devices <NUM> may include a wireless receiver-only capable of intercepting wireless messages exchanged between one or more of the devices <NUM> while incapable of transmitting messages.

Reference is made once again to <FIG> and <FIG>.

As shown at <NUM>, the process <NUM> starts with the message optimizer <NUM> obtaining, for example, receiving, retrieving, fetching, collecting and/or the like one or more of a plurality of messages intercepted by one or more monitoring devices such as the monitor device <NUM> at one or more communication channels such as the communication channels <NUM> and/or segments thereof.

The intercepted messages transmitted by one or more devices such as the device <NUM> include one or more fields, for example, a message identifier (type), an originating device identifier, a destination device identifier, a time stamp, a payload size indicator, a payload, a metadata, a protocol related field, a reserved field and/or the like.

In order to temporally and/or spatially correlate the intercepted messages, time and/or space (location) attributes may be required for the intercepted messages, for example, a time stamp indicating a time of interception of the respective message, an origin communication channel <NUM> where the respective message is intercepted and/or the like.

Some communication protocols, for example, Transmission Control Protocol (TCP/IP) and the Internet Protocol (IP) (TCP/IP) may inherently include such time and/or space attributes. For example, in Transmission Control Protocol (TCP/IP) and the Internet Protocol (IP) (TCP/IP) each message includes a time stamp field indicating a time of transmission of the respective message. In another example, in TCP/IP and the Internet Protocol (IP) (TCP/IP) each message includes a field indicating an IP address of the originating device <NUM> and/or a field indicating an IP address of the destination device <NUM>.

However, other communication protocols may not define such time and/or space attributes. In such case the monitoring device(s) <NUM> may extend one or more of the intercepted messages, for example, adding a metadata to the intercepted message(s) to include these time and/or space attributes, specifically, the time stamp, the origin communication channel <NUM> and/or the like. As part of the intercepted message, the monitoring device(s) <NUM> may provide the extension, for example, the metadata to the message optimizer <NUM>. The metadata may further include additional attributes, for example, a protocol of the intercepted message (e.g. CAN, TCP/IP, LIN, etc.). For brevity the extension to the message added by the monitoring device(s) <NUM> is considered herein after as an additional field(s) of the intercepted message.

As shown at <NUM>, the message optimizer <NUM> applies one or more trained machine learning models, for example, a parametric machine learning model, a non-parametric machine learning model, a supervised machine learning model, an unsupervised machine learning model, a semi-supervised machine learning model and/or the like to analyze one or more of the intercepted messages in order to identify one or more data patterns. The machine learning models may include one or more machine learning probabilistic models, engines and/or algorithms, for example, a neural network, a support vector machine (SVM), a decision tree, a K-Nearest neighbors algorithm, a context tree, a graphical model, a Bayesian net, a random forest, a rotational forest, a deep learning algorithm and/or any other learning algorithm trained as known in the art. The machine learning models may further include spectral clustering, hashing, boosting and/or the like.

The data patterns may include, for example, a constant value, an incrementing value, a decrementing value, a finite range of discrete values and/or the like.

The machine learning model(s) is trained to identify the data patterns during a training phase with a plurality of training datasets comprising training message designed, constructed and/or selected to represent the messages exchanged in the vehicle operational environment of the vehicle <NUM>. For example, in case a CAN bus is deployed in the vehicle <NUM>, the training datasets used to train the machine learning model(s) may include CAN bus messages. In another example, assuming, one of the devices <NUM> is a temperature sensor, the training datasets used to train the machine learning model(s) may include messages generated by one or more such temperature sensors and/or simulated to represent messages generated by such temperature sensor(s).

The machine learning model(s) used by the message optimizer <NUM> may be trained with suitable training datasets designed, constructed and/or selected according to the type of the machine learning model as known in the art. For example, a supervised machine learning model may be trained with a plurality of annotated (labeled) training datasets each labeled with a class label associated with a respective one of a plurality of data patterns, specifically, data patterns associated with fields of the training messages. In another example, a non-parametric unsupervised machine learning model may be trained with a plurality of training datasets which are not annotated. In this case, the unsupervised machine learning model may cluster the training datasets to clusters according to the values and/or patterns identified in the intercepted messages and learned over time.

During the training phase the machine learning model(s) is trained to identify, i.e. cluster, classify, map and/or the like one or more data patterns in the intercepted messages. In particular, the machine learning model(s) is trained to identify the data patterns in the fields of the intercepted messages, for example, the message identifier, the originating device identifier, the destination device identifier, the time stamp, the payload size indicator, the payload, the metadata, the protocol related field and/or the like.

For example, applying the trained machine learning model(s), the message optimizer <NUM> may detect a certain field of a certain intercepted message(s) is a message identifier. The message optimizer <NUM> may further identify one or more constant data patterns in the message identifier field of one or more intercepted messages which identify, for example, a type of the intercepted message (e.g. in the CAN bus protocol), a protocol of the intercepted message (e.g. CAN, TCP/IP, MOST, etc.) an index of the intercepted message and/or the like. The identified data patterns may therefore correspond, for example, to the type of messages transmitted over a certain CAN bus communication channel <NUM>.

In another example, applying the trained machine learning model(s), the message optimizer <NUM> may detect a certain field of certain intercepted message(s) is an originating device identifier. For example, in Transmission Control Protocol (TCP) and the Internet Protocol (IP) (TCP/IP), each message includes a field indicating an IP address of the originating device <NUM>. The message optimizer <NUM> may further identify one or more data patterns in the originating device IP address field of one or more intercepted messages. The identified data patterns may therefore correspond, for example, to the IP addresses of the devices <NUM> transmitting TCP/IP messages. In another example, in TCP/IP, each message includes a field indicating an IP address of the destination device <NUM>. The message optimizer <NUM> may further identify one or more data patterns in the destination device IP address field of one or more intercepted messages. The identified data patterns may therefore correspond, for example, to the IP addresses of the devices <NUM> receiving TCP/IP messages.

In another example, applying the trained machine learning model(s), the message optimizer <NUM> may detect a certain field of certain intercepted message(s) is a time stamp of the intercepted message(s). As described herein before, the time stamp filed may be available in messages utilizing one or more communication protocols, for example, TCP/IP and/or the like. Additionally and/or alternatively as described herein before, the time stamp field may be included in the metadata field or part thereof if added by the monitoring device(s) <NUM>. For example, the message optimizer <NUM> may identify incrementing or decrementing data pattern(s) in a certain field of a plurality of intercepted messages and may therefore determine that the certain field is the time stamp field of the intercepted messages. The identified data patterns may therefore correspond, for example, to timing values indicating timing (e.g. time, data, etc.) of transmission and/or of interception of the respective intercepted message(s).

In another example, applying the trained machine learning model(s), the message optimizer <NUM> may detect a certain field of certain intercepted message(s) is a payload of the intercepted message(s). For example, the message optimizer <NUM> may identify one or more sets of finite values (e.g. a set, a range, etc.) in a certain field of a plurality of intercepted messages and may therefore determine that the certain field is the payload of the intercepted messages. The identified data patterns may correspond, for example, to a set and/or a range of status data values transmitted by one or more of the devices <NUM> such as for example, a range of sensor reading values, a set operational status values and/or the like. In another example, the identified data patterns may correspond, for example, to a set and/or a range of control data values transmitted by one or more of the devices <NUM> such as for example, a set of command codes, a set of instructions values and/or the like.

In another example, applying the trained machine learning model(s), the message optimizer <NUM> may detect one or more fields of certain intercepted message(s) is a protocol related and/or reserved fields, for example, a flag, a field, a code and/or the like. For example, in the CAN bus protocol one or more fields in a message are reserved. In another example, one or more fields of the messages may be used by one or more of the communication protocols for controlling message flow, for example, arbitration, handshake, acknowledge, priority and/or the like. For example, in the CAN bus protocol, a certain bit field in each CAN message is an acknowledge delimiter field. In another example, in the CAN bus protocol, a certain bit field at the end of each CAN message is an End of Message (EOF) indication field.

Optionally, the machine learning model(s) is trained for sub-message analysis to identify one or more of the data patterns in a portion (part) of one or more of the fields of the intercepted messages, in particular a portion (segment) of the payload.

The payload of one or more of the messages exchanged over the communication channel(s) <NUM> may include multiple functional data segments where each of the data segments relates to a different function, operation, device <NUM> and/or the like. Similarly to the payload fields, the functional data segments of the payload may include various types of data, for example, constant data, a set of discrete values (or range), a counter value (incrementing or decrementing), an uncontrolled value and/or the like. For example, a certain payload of a certain message may include sensor reading values obtained from a plurality of sensors such that the value of each of the sensors is encoded with a set of bit(s) in a separate segment of the certain payload.

The machine learning model(s) may therefore be trained to evaluate entropy of the payload of one or more of the messages to identify the multiple data segments in the payload and further identify one or more patterns in the data segments. Applying the trained machine learning model(s), the message optimizer <NUM> may thus detect the functional data segments in the payload of one or more of the intercepted messages.

As shown at <NUM>, the message optimizer <NUM> adjusts one or more of the intercepted messages by replacing one or more data patterns identified in a certain intercepted message with a reduced size representation of the data pattern. The reduced size representation may be predefined such that each of a plurality of data pattern learned during the training phase exclusively corresponds (one-to-one) to a respective reduced size representation of the data pattern. Moreover, the message optimizer <NUM> may adjust the intercepted message(s) by replacing data patterns identified in the learned fields of the intercepted messages, for example, the message identifier (type), the originating device identifier, the destination device identifier, the time stamp, the payload size indicator, the payload and/or part thereof, the metadata, the protocol related field and/or the like.

The reduced size representation of the data pattern is lossless such that all the data of the data pattern may be extracted from the respective reduced size representation with no data loss and/or ambiguity.

The reduced size representations of the detected data patterns are mapped in a dataset, for example, a list, a table, a database and/or the like comprising a plurality of entries each associating one of the learned data patterns with a respective one of a plurality of predefined reduced size representations. The dataset may be maintained by both the optimization system <NUM> thus available to the message optimizer <NUM> and by the remote server <NUM>. Moreover, the reduced size representations may be implemented as indices in the dataset such that each of the reduced size representations points to the entry holding its respective data pattern in the dataset. Having access to the dataset, both the message optimizer <NUM> and the remote server <NUM> may be able to correctly encode and decode the predefined reduced size representation(s) to extract the respective original data pattern(s) replaced by the message optimizer <NUM> with the predefined reduced size representation(s).

Continuing the previously presented examples, assuming the message optimizer <NUM> identifies a plurality of data patterns corresponding to a plurality of message identifiers (e.g. message types in the CAN protocol, protocol types, etc.) detected in a message identifier field of a plurality of intercepted messages. Typically the message identifier field may be significantly large, for example, <NUM> bits to support encoding a high number of message types, for example, <NUM>. However the number of message types actually exchanged in a specific environment of a certain vehicle <NUM>, i.e. over the communication channel(s) <NUM> may be significantly smaller, for example, <NUM>. The message identifier field may therefore be significantly reduced, for example, to <NUM> bits since only a subset (<NUM>) of the message types needs to be encoded. In such case, the message optimizer <NUM> may replace the original <NUM>-bit message type codes (data patterns) with a predefined significantly reduced size <NUM>-bit code (representation) to map the <NUM> message types. However, as described, the predefined codes are defined such that they are sufficient for distinguishing between the message types detected at the certain vehicle <NUM>, i.e. lossless representation of the original message type.

In another example, assuming the message optimizer <NUM> identifies a plurality of data patterns corresponding to a plurality of originating device identifiers detected in a message originating device identifier field of a plurality of intercepted messages. Typically the originating device identifier field may be significantly large to support encoding a high number of originating devices <NUM> deployed in the vehicle <NUM> and transmitting messages over the communication channel(s) <NUM>. However the number of originating devices <NUM> actually deployed in the vehicle <NUM> and capable of transmitting messages may be significantly smaller. The originating device identifier field may therefore be significantly reduced to support encoding only the originating devices <NUM> actually deployed in the vehicle <NUM>. For example, assuming the size of the originating device identifier field is <NUM> bits to map <NUM> originating devices. However, the actual number of devices <NUM> deployed in the vehicle <NUM> may be much lower, for example, <NUM>. In such case the message optimizer <NUM> may replace the original <NUM>-bit originating device identifier codes (data patterns) with a predefined significantly reduced size <NUM>-bit code (representation) to map the <NUM> devices <NUM>.

In another example, assuming the message optimizer <NUM> identifies a plurality of data patterns corresponding to one or more sets and/or finite ranges of values detected in a payload field and/or part thereof of a plurality of intercepted messages. The size of the payload may be significantly large to support encoding a high number of values of the set(s) and/or range(s). However the number of values possible for the set(s) and/or range(s) may be significantly smaller. The payload field and/or one or more of its parts may therefore be significantly reduced to support encoding only the values relevant for the operational environment of the vehicle <NUM>. For example, assuming the size of the payload is <NUM> bytes to map a sensor reading range of <NUM> values of for a certain sensor <NUM>. However, the actual reading range the certain sensor <NUM> is actually capable of may be significantly smaller, for example, <NUM> values. In such case the message optimizer <NUM> may replace the original <NUM>-byte values (data patterns) with a predefined significantly reduced size <NUM>-bit code (representation) to map the range of <NUM> values captured by the certain sensor <NUM>.

In another example, assuming the message optimizer <NUM> identifies one or more data patterns corresponding to one or more protocol related and/or reserved fields. In such case the message optimizer <NUM> may optionally remove one or more of the protocol related and/or reserved fields. For example, in the CAN bus protocol, the message optimizer <NUM> may remove the acknowledge delimiter field and/or the EOF indication field in the reduced size message(s).

Moreover, assuming the message optimizer <NUM> identifies an incrementing or decrementing data pattern corresponding to a time stamp, a counter, a timer and/or the like field of a plurality of intercepted messages. The time stamp defined by one or more of the protocols used by at least some of the devices <NUM> deployed in the vehicle <NUM> may be significantly large, for example, <NUM> bits (<NUM> bytes) to express an absolute high resolution timing, for example, a date, a day of week, a time including fractions of time (e.g. hours, minutes, seconds, milliseconds, microseconds, nanoseconds, etc.) and/or the like. However, the transmission rate of one or more of intercepted message via the communication channel(s) <NUM> may be significantly low resulting in a significantly high transmission time of the intercepted message(s). The high resolution time stamp expressing, for example, the microseconds and/or the nanoseconds may be irrelevant and/or of no benefit due to the significantly lower transmission rate. For example, assuming one of the communication channel <NUM> is a CAN bus operating at 256Kbit per second. A <NUM>-byte message (containing an <NUM>-byte payload) transmitted by one of the devices <NUM> the CAN bus may take approximately <NUM> milliseconds. The message optimizer <NUM> may therefore replace the high resolution time stamp with a reduced size representation comprising a time stamp having a size of, for example, <NUM> bytes in which the milliseconds field is maintained and the microseconds and/or the nanoseconds fields are discarded (i.e. removed, deleted).

Furthermore, the message optimizer <NUM> may replace an absolute time stamp detected by its incrementing or decrementing data pattern in a plurality intercepted messages with a relative time stamp expressing the time stamp of a current message with respect to the time stamp of one or more previously intercepted messages. For example, the message optimizer <NUM> may maintain lower resolution segment(s) of the time stamp such as the date, day of week, hour and/or the like in an intercepted message once every predefined period, for example, once an hour. The message optimizer <NUM> may maintain may maintain the next higher resolution segment(s) of the time stamp, for example, the minute count and/or the seconds count in an intercepted message once every second. The message optimizer <NUM> may adjust the rest of the intercepted messages to include the relative time maintaining, for example, only millisecond from the most recent periodically maintained intercepted messages. As such the reduced size representation of the relative time stamp of most of the adjusted messages may be significantly reduced compared to the absolute time stamp.

Replacing the data pattern(s) with their respective predefined reduced size representation(s) may in turn significantly reduce a size of the intercepted message(s) thus the adjusted messages may be significantly smaller in size compared to the respective intercepted messages.

As shown at <NUM>, the message optimizer <NUM> outputs the adjusted message(s). The message optimizer <NUM> transmits (upload) the adjusted intercepted message(s) to the remote server <NUM>. The bandwidth required for transmitting (uploading) the adjusted (reduced size) messages from the optimization system <NUM> at the vehicle <NUM> to the remote server <NUM> may be significantly lower than the bandwidth required for transmitting the originally intercepted messages.

The remote server <NUM> may process the received adjusted message(s) to recover, for example, restore, reconstruct, decode, extract and/or the like the originally intercepted message(s) before further analyzing the message(s). The remote server <NUM> may apply one or more analyses on the restored intercepted message(s) for one or more of a plurality of applications, for example, predictive maintenance, anomaly detection, forensics, fleet management and/or the like.

Additionally and/or alternatively, the message optimizer <NUM> locally stores one or more of the adjusted (reduced size) messages, for example, in the storage <NUM>. The locally stored adjusted messages may be later locally analyzed at the vehicle <NUM> and/or uploaded (transmitted to the remote server <NUM> at a later time, for example, while the vehicle <NUM> is parked. The storage resources (e.g. capacity, etc.) required for storing the adjusted messages at the vehicle <NUM> may be significantly lower than the storage resources required for storing the originally intercepted messages.

It is expected that during the life of a patent maturing from this application many relevant systems, methods and computer programs will be developed and the scope of the terms machine learning models and/or vehicle communication channels are intended to include all such new technologies a priori.

Claim 1:
A computer implemented method of reducing a size of a message intercepted on a communication channel (<NUM>) of a vehicle (<NUM>), the method comprising:
receiving, by a device (<NUM>) deployed in a vehicle (<NUM>), at least one of a plurality of messages intercepted by at least one monitoring device (<NUM>) adapted to monitor messages transmitted via at least one segment of at least one segmented communication channel (<NUM>) of the vehicle (<NUM>), said at least one monitoring device (<NUM>) is coupled to the at least one communication channel (<NUM>) in an isolated manner such that said monitoring device (<NUM>) is incapable of inducing, altering, manipulating and/or affecting transmission signals of the at least one communication channel (<NUM>);
applying, by the device (<NUM>), at least one trained machine learning model to identify at least one of a plurality of data patterns in the at least one message;
adjusting, by the device (<NUM>), the at least one message by replacing the at least one identified data pattern with a respective predefined lossless representation having a reduced size compared to the at least one identified data pattern; and
transmitting, by the device (<NUM>), the at least one adjusted message to a remote system (<NUM>) via at least one upload communication channel (<NUM>);
wherein the at least one machine learning model is trained with a plurality of training messages to identify the at least one data pattern in at least one field of the at least one message, the at least one field is a member of a group consisting of: a message identifier, an originating device identifier, a destination device identifier, a time stamp, a payload size indicator, a payload, a metadata and a protocol related field.