CN114978630A - Safety event detection system and method for vehicle-mounted CAN network and storage medium - Google Patents
Safety event detection system and method for vehicle-mounted CAN network and storage medium Download PDFInfo
- Publication number
- CN114978630A CN114978630A CN202210514856.5A CN202210514856A CN114978630A CN 114978630 A CN114978630 A CN 114978630A CN 202210514856 A CN202210514856 A CN 202210514856A CN 114978630 A CN114978630 A CN 114978630A
- Authority
- CN
- China
- Prior art keywords
- detection
- data
- rule
- log
- logs
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Withdrawn
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H04L63/1425—Traffic logging, e.g. anomaly detection
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L12/00—Data switching networks
- H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
- H04L12/40—Bus networks
- H04L12/40006—Architecture of a communication node
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
- H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H04L63/1416—Event detection, e.g. attack signature detection
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/01—Protocols
- H04L67/12—Protocols specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L12/00—Data switching networks
- H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
- H04L12/40—Bus networks
- H04L2012/40208—Bus networks characterized by the use of a particular bus standard
- H04L2012/40215—Controller Area Network CAN
-
- Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
- Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
- Y02P—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN THE PRODUCTION OR PROCESSING OF GOODS
- Y02P90/00—Enabling technologies with a potential contribution to greenhouse gas [GHG] emissions mitigation
- Y02P90/02—Total factory control, e.g. smart factories, flexible manufacturing systems [FMS] or integrated manufacturing systems [IMS]
Abstract
The invention discloses a security event detection system, a security event detection method and a storage medium of a vehicle-mounted CAN (controller area network), wherein the system comprises a CAN message mirror module, a rule management module, a detection engine and a log management module, the CAN message mirror module is used for caching and managing received data after receiving the data from the CAN network and transmitting the data to the detection engine, and the rule management module is used for editing and updating rules, generating rule files used by parts and sending the generated rule files to the detection engine; the detection engine is used for caching data transmitted by the CAN message mirror image module, receiving the rule file, matching the cached data with the corresponding rule file to form a detection log and transmitting the detection log to the log management system; the log management system is used for receiving the detection logs and the state logs, forming attack logs by the state logs and the detection logs, and then storing and transmitting the attack logs.
Description
Technical Field
The invention belongs to the field of vehicle networking safety, and particularly relates to a system and a method for detecting a safety event of a vehicle-mounted CAN (controller area network) and a storage medium.
Background
The CAN network is a main network for communication of parts in the current vehicle, and communication of each control unit in the vehicle is mostly realized through a CAN bus. Along with the popularization of intelligent networking automobiles, the number of automobile control units, external communication ports and external equipment is continuously increased, and the complexity of automobile communication is higher and higher.
At present, chinese patent publication No. 111988342 discloses an online automobile CAN network anomaly detection system, which includes: training the CAN network anomaly detection model according to the characteristics of regions, the characteristics of users, the characteristics of vehicle products and the characteristics of full-network security attack change to obtain a cloud server of the trained CAN network anomaly detection model; the cloud server transmits the trained CAN network anomaly detection model to different vehicle-mounted terminals to detect CAN network anomalies of the automobile, and meanwhile, the vehicle-mounted terminals transmit real-time operation data of the automobile to the cloud server to update the CAN network anomaly detection model, so that the automobile CAN be upgraded in real time and has better expansibility.
The detection mode needs to train the abnormal detection models of the CAN networks of different vehicles for a long time, and when different vehicle types are detected, different abnormal detection models are required to train, so that the method is not beneficial to popularization. Meanwhile, the detection mode is long in period and needs a large calculation model temporarily.
Disclosure of Invention
Aiming at the defects of the prior art, the technical problems to be solved by the invention are as follows: how to provide a safety event detection system, a method and a storage medium which are applicable to various vehicle types, have high detection accuracy and simple and quick detection mode and are used for a vehicle-mounted CAN network.
In order to solve the technical problems, the invention adopts the following technical scheme:
a safety event detection system of a vehicle-mounted CAN network is characterized by comprising a CAN message mirror module, a rule management module, a detection engine and a log management module, wherein the CAN message mirror module is used for caching and managing received data after receiving the data from the CAN network and transmitting the data to the detection engine; the detection engine is used for caching data transmitted by the CAN message mirror image module, receiving the rule file transmitted by the rule management module, performing data matching detection on the cached data and the corresponding rule file, forming a detection log according to a detection result and transmitting the detection log to the log management system; the log management system is used for receiving the detection logs and the state logs sent by the CAN bus or the automobile parts, forming attack logs by the state logs and the detection logs, and storing and transmitting the attack logs.
Therefore, the detection system sets and edits the rules for using the parts and synchronously acquires the use data of the parts, so that after the rules are matched with the use data, whether the parts are attacked or not can be judged, whether the parts are abnormal or not in use is judged, a detection result is obtained, the detection log and the state log corresponding to the parts form an attack log together and then the attack log is transmitted to the cloud, the storage space of the log management system can be effectively reduced, and the attack log can be conveniently checked by a background. The system has fewer modules, and the detection mode is simple and quick.
Further, the rule management module includes an external rule management module and an internal rule management module, the external rule management module is configured to edit a rule to generate a rule file usable by the component, and the internal rule management module is configured to issue the rule generated by the external rule management module to the detection engine. Therefore, the rule can be edited in real time according to the service condition of the vehicle during rule making so as to adapt to different vehicle types and edit different detection rules.
Further, the external rule management module and the internal rule management module are connected through an OTA or a flash tool.
A safety event detection method of a vehicle-mounted CAN network is characterized by comprising the following steps: step 1, editing a rule file used by a part, and sending the rule file to a detection engine; meanwhile, real-time use data of the parts are received from the CAN driver through the CAN message mirror system, and the data are sent to the detection engine; step 2, the detection engine receives the rule files and the use data of the cache parts, performs data matching detection on the cached data and the corresponding rule files to obtain a detection result, and sends the detection log to a log management system after forming the detection log; and 3, receiving and caching the detection logs and the status logs of the parts by the log management system, fusing the detection logs of the parts and the status logs of the corresponding parts to form attack logs, transmitting the attack logs to the Tbox, and transmitting the attack logs to the TSP cloud platform by the Tbox.
Further, in step 1, after the CAN message mirroring system acquires data from the CAN driver, the CAN data and the CANFD data are respectively stored in the shared memory, the data in the shared memory is identified, the CAN data and the CANFD data are classified and copied to the memory of the detection engine in a queue data format in a dequeue and enqueue manner for the detection engine to perform detection. The method can perform classified detection aiming at different bus protocols, can reduce the complexity of the detection method and improve the accuracy to a certain extent.
Further, in step 2, after receiving the rule file, the detection engine initializes the detection engine to a format following the detection rule, and then performs rule matching. After initialization, rule mismatching can be prevented from causing inaccurate rule matching.
Further, after rule matching, if the matching result is that the part data is not abnormal, the matching result does not need to be output, and if the matching result is that the part data is abnormal, the detection result is output; and if no corresponding data is matched, throwing out the data which cannot be matched, and sending the data to the background after the data is recorded by the log. The conditions of successful matching, abnormal matching and no matching are fully considered, and the false alarm rate is reduced.
Furthermore, after the storage space of the log management system is full, the updated attack logs cover the attack logs with the earliest time, and the processes are circulated in sequence. Therefore, the method can effectively save the storage space, and meanwhile, the log data is not easy to lose.
Furthermore, before the log management system stores and transmits the attack logs, the attack logs are encrypted, and an encryption algorithm meets AES128 and above. Therefore, the safety of the vehicle data can be effectively improved, and the data is prevented from being stolen or attacked.
A computer-readable storage medium, in which a computer program is stored, which, when being executed by a processor, implements a method for security event detection of an in-vehicle CAN network as set forth above.
Drawings
Fig. 1 is a structural diagram of a security event detection system of an onboard CAN network in an embodiment.
Detailed Description
The invention is further illustrated with reference to the following figures and examples.
Example (b):
as shown in fig. 1, the system for detecting a security event of a vehicle-mounted CAN network provided in this embodiment includes a CAN message mirroring module, a rule management module, a detection engine, and a log management module, where the CAN message mirroring module is configured to receive data from the CAN network, cache and manage the received data, and transmit the data to the detection engine, and the rule management module is configured to edit and update rules, generate a rule file used by a component, and send the generated rule file to the detection engine; the detection engine is used for caching data transmitted by the CAN message mirror image module, receiving the rule file transmitted by the rule management module, performing data matching detection on the cached data and the corresponding rule file, forming a detection log according to a detection result and transmitting the detection log to the log management system; the log management system is used for receiving the detection logs and state logs (namely vehicle states including time, places, vehicle mark values and the like when an attack is detected) sent by the CAN bus or the automobile parts, forming the attack logs by the state logs and the detection logs, and then storing and transmitting the attack logs.
Specifically, the rule management module in this embodiment has two parts, an external rule management module and an internal rule management module. The external rule management module is not in the part, but on the background or other equipment, and is used for editing the rule to generate a rule file which can be used by the part; the internal rule management module is in the component (i.e. the current rule management system), and is used for issuing the rule generated by the external rule management module to the detection engine to realize the operations of rule import, update and the like. The external rule management module and the internal rule management module can be connected through an OTA or a flash tool, and a file generated by the external system is transmitted to the internal system through an OTA function or the flash tool and then is issued to the detection engine by the internal system.
Usually, the gateway is a data collection point of the whole automobile, and it is more appropriate to detect the network security event on the gateway. The solution is to detect at the gateway (or class is such a central point of the network). Firstly, a CAN message copying system is deployed at a gateway, CAN network data is received and managed, a detection engine is deployed to realize detection and blocking of specific rules, a policy management system is deployed upwards to realize issuing and management of policies, and finally a log management system stores, records and transmits results.
Specifically, the method for detecting the security event of the vehicle-mounted CAN network in the embodiment includes the following steps: step 1, editing a rule file used by a part, and sending the rule file to a detection engine; meanwhile, real-time use data of the parts are received from the CAN driver through the CAN message mirror system, and the data are sent to the detection engine; step 2, the detection engine receives the rule files and the use data of the cache parts, performs data matching detection on the cached data and the corresponding rule files to obtain a detection result, and sends the detection log to a log management system after forming the detection log; and 3, receiving and caching the detection logs and the status logs of the parts by the log management system, fusing the detection logs of the parts and the status logs of the corresponding parts to form attack logs, transmitting the attack logs to the Tbox, and transmitting the attack logs to the TSP cloud platform by the Tbox.
In step 1, after the CAN message mirroring system acquires data from the CAN driver, the CAN data and the CANFD data are respectively stored in the shared memory, the data in the shared memory is identified, the CAN data and the CANFD data are classified and copied to the memory of the detection engine in a queue data format in a dequeue and enqueue manner, so that the detection engine CAN perform detection work.
In step 2, after receiving the rule file, the detection engine initializes the detection engine to a format following the detection rule, and then performs rule matching. After rule matching, if the matching result is that the part data is not abnormal, the matching result is not required to be output, and if the matching result is that the part data is abnormal, the detection result is output; if the corresponding data are not matched, throwing out the data which cannot be matched, and sending the data to a background after the data are recorded by a log. A set of corresponding processing strategies should be applied to data which cannot be matched with the rules, and the method directly carries out throwing-out processing, log recording and manual auditing on the data which cannot be matched.
The following points should be observed when the detection engine is designed: the memory of the host computer is saved as much as possible. The gateway is a crucial link in the CAN network in the vehicle, and all memories of the gateway are generally not too large, and if a detection engine occupies more memories, normal functions may be affected; and detecting load optimization. Like the first rule, the normal functions of the gateway are not influenced as much as possible, and all loads need to be optimized; and thirdly, a structure which can be cached for the specific message is required. The CAN data needs to be copied to the memory of the detection engine for detection, and meanwhile, the normal function is not influenced. And fourthly, layering the message processing logic so as to achieve the modularization of the detection engine. The modularization aims at facilitating the deployment and problem troubleshooting of the detection engine, enabling the structure of the detection engine to be clearer and facilitating post-processing. The modularization measure is to process the messages layer by layer in a hierarchical manner and divide the modules.
The logs stored by the log management system are divided into two types, one type is a detection log and comprises characteristic values such as detection results; one type is a state log (acquired by a CAN bus and parts), namely the vehicle state when the attack is detected, including time, place, vehicle mark value and the like; the two types of logs finally form an attack log for storage. The log needs to be encrypted for storage and transmission because of more sensitive information. The algorithm meets AES128 and above. For the storage space, because the size is limited, the covering method is adopted to ensure that the storage space is not influenced, and after the storage space is full, the newest log covers the oldest log and the cycle is performed in sequence. The method adopts UDS protocol transmission. And when an attack event is detected, the log management module transmits the log Tbox through the UDS function and finally transmits the log Tbox to the TSP cloud platform.
The following test rules are compiled in this method (see the following table for details):
the present embodiment also provides a computer-readable storage medium storing a computer program which, when executed by a processor, implements the security event detection method of the in-vehicle CAN network as described above.
Finally, it should be noted that the above embodiments are only used for illustrating the technical solutions of the present invention and not for limiting the technical solutions, and although the present invention has been described in detail by referring to the preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions to the technical solutions of the present invention can be made without departing from the spirit and scope of the technical solutions, and all the modifications and equivalent substitutions should be covered by the claims of the present invention.
Claims (10)
1. A safety event detection system of a vehicle-mounted CAN network is characterized by comprising a CAN message mirror module, a rule management module, a detection engine and a log management module, wherein the CAN message mirror module is used for caching and managing received data after receiving the data from the CAN network and transmitting the data to the detection engine; the detection engine is used for caching data transmitted by the CAN message mirror image module, receiving the rule file transmitted by the rule management module, performing data matching detection on the cached data and the corresponding rule file, forming a detection log according to a detection result and transmitting the detection log to the log management system; the log management system is used for receiving the detection logs and the state logs sent by the CAN bus or the automobile parts, forming attack logs by the state logs and the detection logs, and storing and transmitting the attack logs.
2. The system of claim 1, wherein the rule management module comprises an external rule management module and an internal rule management module, the external rule management module is configured to edit rules to generate a rule file usable for the component, and the internal rule management module is configured to issue the rules generated by the external rule management module to the detection engine.
3. The system of claim 2, wherein the external rule management module and the internal rule management module are connected via an OTA or a flash tool.
4. A safety event detection method of a vehicle-mounted CAN network is characterized by comprising the following steps: step 1, editing a rule file used by a part, and sending the rule file to a detection engine; meanwhile, real-time use data of the parts are received from the CAN driver through the CAN message mirror system, and the data are sent to the detection engine; step 2, the detection engine receives the rule files and the use data of the cache parts, performs data matching detection on the cached data and the corresponding rule files to obtain a detection result, and sends the detection log to a log management system after forming the detection log; and 3, receiving and caching the detection logs and the status logs of the parts by the log management system, fusing the detection logs of the parts and the status logs of the corresponding parts to form attack logs, transmitting the attack logs to a Tbox, and transmitting the attack logs to the TSP cloud platform by the Tbox.
5. The method according to claim 4, wherein in step 1, after the CAN message mirroring system obtains data from the CAN driver, the CAN data and the CANFD data are respectively stored in the shared memory, the data in the shared memory is identified, the CAN data and the CANFD data are classified, and the classified CAN data and the CANFD data are copied to the detection engine memory in a queue data format in a dequeue and enqueue manner for the detection engine to perform detection.
6. The method according to claim 5, wherein in step 2, after receiving the rule file, the detection engine initializes the detection engine to a format following the detection rule, and then performs rule matching.
7. The method according to claim 6, wherein after the rule matching, if the matching result is that the part data is not abnormal, the matching result is not required to be output, and if the matching result is that the part data is abnormal, the detection result is output; and if no corresponding data is matched, throwing out the data which cannot be matched, and sending the data to the background after the data is recorded by the log.
8. The method of claim 4, wherein the updated attack log covers the earliest attack log in time and is cycled in sequence when the storage space of the log management system is full.
9. The method of claim 4, wherein the status log is a vehicle status when the component is under attack, and comprises time, location, and vehicle flag value.
10. A computer-readable storage medium, in which a computer program is stored which, when being executed by a processor, carries out a method of security event detection of an in-vehicle CAN network according to any one of claims 4 to 9.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210514856.5A CN114978630A (en) | 2022-05-11 | 2022-05-11 | Safety event detection system and method for vehicle-mounted CAN network and storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210514856.5A CN114978630A (en) | 2022-05-11 | 2022-05-11 | Safety event detection system and method for vehicle-mounted CAN network and storage medium |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN114978630A true CN114978630A (en) | 2022-08-30 |
Family
ID=82982376
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202210514856.5A Withdrawn CN114978630A (en) | 2022-05-11 | 2022-05-11 | Safety event detection system and method for vehicle-mounted CAN network and storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN114978630A (en) |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109495439A (en) * | 2017-09-11 | 2019-03-19 | 通用汽车环球科技运作有限责任公司 | System and method for in-vehicle network intrusion detection |
| CN112153070A (en) * | 2020-09-28 | 2020-12-29 | 安徽江淮汽车集团股份有限公司 | Abnormality detection method, device, storage medium and apparatus for vehicle-mounted CAN bus |
| CN113242251A (en) * | 2021-05-20 | 2021-08-10 | 北京九州云驰科技有限公司 | Vehicle-mounted network safety protection system and application method thereof |
| CN114374565A (en) * | 2022-01-30 | 2022-04-19 | 中国第一汽车股份有限公司 | Intrusion detection method and device for vehicle CAN network, electronic equipment and medium |
-
2022
- 2022-05-11 CN CN202210514856.5A patent/CN114978630A/en not_active Withdrawn
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109495439A (en) * | 2017-09-11 | 2019-03-19 | 通用汽车环球科技运作有限责任公司 | System and method for in-vehicle network intrusion detection |
| CN112153070A (en) * | 2020-09-28 | 2020-12-29 | 安徽江淮汽车集团股份有限公司 | Abnormality detection method, device, storage medium and apparatus for vehicle-mounted CAN bus |
| CN113242251A (en) * | 2021-05-20 | 2021-08-10 | 北京九州云驰科技有限公司 | Vehicle-mounted network safety protection system and application method thereof |
| CN114374565A (en) * | 2022-01-30 | 2022-04-19 | 中国第一汽车股份有限公司 | Intrusion detection method and device for vehicle CAN network, electronic equipment and medium |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US11748474B2 (en) | Security system and methods for identification of in-vehicle attack originator | |
| JP6574535B2 (en) | Global car safety system | |
| US11277427B2 (en) | System and method for time based anomaly detection in an in-vehicle communication | |
| US11575699B2 (en) | Security processing method and server | |
| US11949705B2 (en) | Security processing method and server | |
| EP3113529B1 (en) | System and method for time based anomaly detection in an in-vehicle communication network | |
| JP6807906B2 (en) | Systems and methods to generate rules to prevent computer attacks on vehicles | |
| US20180109622A1 (en) | System and method for anomaly detection in diagnostic sessions in an in-vehicle communication network | |
| JP6762347B2 (en) | Systems and methods to thwart computer attacks on transportation | |
| KR20220041137A (en) | Multi-mode messaging anomaly detection for broadcast network security | |
| JP2022176312A (en) | On-vehicle security practice apparatus, on-vehicle security practice method, and security practice system | |
| CN114978630A (en) | Safety event detection system and method for vehicle-mounted CAN network and storage medium | |
| WO2022107268A1 (en) | Control device | |
| Kumbhare et al. | Study of KWP2000, CAN, and UDS Communication Protocols for Automotive Diagnostic | |
| CN114698157A (en) | Intelligent network-connected automobile center safety control gateway system | |
| Daimi | A Security Architecture for Remote Diagnosis of Vehicle Defects |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| WW01 | Invention patent application withdrawn after publication |
Application publication date: 20220830 |
|
| WW01 | Invention patent application withdrawn after publication |