# US 10,484,411 B1 · System for anomaly detection on CAN bus data with sparse and low rank decomposition of transfer entropy matrix

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,484,411 B1
- Document ID: US10484411B1
- Status: Granted
- Kind: B1
- Application number: 15/670,477
- Filed: 2017-08-07
- Granted: 2019-11-19
- Earliest claimed: 2016-10-07
- Assignees: HRL Laboratories, LLC
- Applicants: HRL Laboratories, LLC
- Inventors: Kang-Yu Ni; David W. Payton
- Web page: https://patentgrep.com/patent/US10484411B1

## CPC

- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- G06F 13/3625: {using a time dependent access}
- H04L 1/0681: {adapting space time parameters, i.e. modifying the space time matrix}
- H04L 9/002: {Countermeasures against attacks on cryptographic mechanisms (network architectures or network communication protocols for protection against malicious traffic H04L63/1441)}
- H04L 12/40: Bus networks
- H04L 63/0218: {Distributed architectures, e.g. distributed firewalls}
- H04W 4/40: for vehicles, e.g. vehicle-to-pedestrians [V2P]
- H04W 12/126: Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning
- H04L 2012/40215: {Controller Area Network CAN}
- H04L 2209/84: Vehicles
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

Described is a system for detecting cyber intrusions based on analysis of network traffic. During operation, the system performs a statistical analysis of message timing on network traffic to produce a temporal dependency matrix representative of temporal dependency between different message types in the network traffic. The sets of temporal dependency matrices are decomposed into component matrices, where at least one component matrix represents typical properties of these matrices and at least one other component matrix represents atypical properties of the matrices. A new temporal dependency matrix is generated based on new network traffic. Finally, anomalous behavior is detected in the new network traffic by comparing component matrices of the new temporal dependency matrix with component matrices of the temporal dependency matrices under normal operation conditions.

## Claims

### Claim 1

A system for detecting cyber intrusions based on analysis of network traffic, the system comprising:
one or more processors and a memory, the memory being a non-transitory computer-readable medium having executable instructions encoded thereon, such that upon execution of the instructions, the one or more processors perform operations of:
performing a statistical analysis of message timing on network traffic to produce a temporal dependency matrix representative of temporal dependency between different message types in the network traffic;
decomposing sets of temporal dependency matrices into component matrices, where at least one component matrix represents typical properties of these matrices and at least one other component matrix represents atypical properties of the matrices;
generating a new temporal dependency matrix based on new network traffic; and
detecting anomalous behavior in the new network traffic by comparing component matrices of the new temporal dependency matrix with component matrices of the temporal dependency matrices under normal operating conditions.

### Claim 2 (depends on 1)

The system as set forth in claim 1, wherein temporal dependency matrix representative of temporal dependency between different message types in the network traffic is a Transfer Entropy Matrix (TEM) produced using Transfer Entropy calculations.

### Claim 3 (depends on 2)

The system as set forth in claim 2, wherein decomposing sets of temporal dependency matrices into component matrices is performed using sparse low-rank decomposition.

### Claim 4 (depends on 3)

The system as set forth in claim 3, wherein detecting anomalous behavior in the new network traffic is performed by first performing sparse low-rank decomposition of individual Transfer Entropy matrices (TEM) and then comparing an 1 norm of a sparse component, ∥zS∥1 with a mean of a training set norm.

### Claim 5 (depends on 4)

The system as set forth in claim 4, wherein detecting anomalous behavior in the new network traffic further comprises determining a norm and standard deviation from sparse low-rank decompositions of multiple TEMs and performing a t-test to determine when the new network traffic exceeds a pre-set bound.

### Claim 6 (depends on 5)

The system as set forth in claim 5, wherein upon detecting anomalous behavior in the new network traffic, further comprising an operation of initiating a reactive response.

### Claim 7 (depends on 6)

The system as set forth in claim 6, wherein the reactive response includes causing a vehicle to initiate a safe-mode, where at least one vehicle system is disabled.

### Claim 8 (depends on 1)

The system as set forth in claim 1, wherein decomposing sets of temporal dependency matrices into component matrices is performed using sparse low-rank decomposition.

### Claim 9 (depends on 1)

The system as set forth in claim 1, wherein detecting anomalous behavior in the new network traffic is performed by first performing sparse low-rank decomposition of individual Transfer Entropy matrices (TEM) and then comparing an 1 norm of a sparse component, ∥zS∥1 with a mean of a training set norm.

### Claim 10 (depends on 1)

The system as set forth in claim 1, wherein detecting anomalous behavior in the new network traffic further comprises determining a norm and standard deviation from sparse low-rank decompositions of multiple Transfer Entropy matrices (TEM) and performing a t-test to determine when the new network traffic exceeds a pre-set bound.

### Claim 11 (depends on 1)

The system as set forth in claim 1, wherein upon detecting anomalous behavior in the new network traffic, further comprising an operation of initiating a reactive response.

### Claim 12 (depends on 11)

The system as set forth in claim 11, wherein the reactive response includes causing a vehicle to initiate a safe-mode, where at lest one vehicle system is disabled.

### Claim 13

A computer program product for detecting cyber intrusions based on analysis of network traffic, the computer program product comprising:
a non-transitory computer-readable medium having executable instructions encoded thereon, such that upon execution of the instructions by one or more processors, the one or more processors perform operations of:
performing a statistical analysis of message timing on network traffic to produce a temporal dependency matrix representative of temporal dependency between different message types in the network traffic;
decomposing sets of temporal dependency matrices into component matrices, where at least one component matrix represents typical properties of these matrices and at least one other component matrix represents atypical properties of the matrices;
generating a new temporal dependency matrix based on new network traffic; and
detecting anomalous behavior in the new network traffic by comparing component matrices of the new temporal dependency matrix with component matrices of the temporal dependency matrices under normal operating conditions.

### Claim 14 (depends on 13)

The computer program product as set forth in claim 13, wherein temporal dependency matrix representative of temporal dependency between different message types in the network traffic is a Transfer Entropy Matrix (TEM) produced using Transfer Entropy calculations.

### Claim 15 (depends on 13)

The computer program product as set forth in claim 13, wherein decomposing sets of temporal dependency matrices into component matrices is performed using sparse low-rank decomposition.

### Claim 16 (depends on 13)

The computer program product as set forth in claim 13, wherein detecting anomalous behavior in the new network traffic is performed by first performing sparse low-rank decomposition of individual Transfer Entropy matrices (TEM) and then comparing an 1 norm of a sparse component, ∥zS∥1 with a mean of a training set norm.

### Claim 17 (depends on 13)

The computer program product as set forth in claim 13, wherein detecting anomalous behavior in the new network traffic further comprises determining a norm and standard deviation from sparse low-rank decompositions of multiple Transfer Entropy matrices (TEMs) and performing a t-test to determine when the new network traffic exceeds a pre-set bound.

### Claim 18 (depends on 13)

The computer program product as set forth in claim 13, wherein upon detecting anomalous behavior in the new network traffic, further comprising instructions for causing the one or more processors to perform an operation of initiating a reactive response.

### Claim 19 (depends on 18)

The computer program product as set forth in claim 18, wherein the reactive response includes causing a vehicle to initiate a safe-mode, where at least one vehicle system is disabled.

### Claim 20

A computer implemented method for detecting cyber intrusions based on analysis of network traffic, the method comprising an act of:
causing one or more processers to execute instructions encoded on a non-transitory computer-readable medium, such that upon execution, the one or more processors perform operations of:
performing a statistical analysis of message timing on network traffic to produce a temporal dependency matrix representative of temporal dependency between different message types in the network traffic;
decomposing sets of temporal dependency matrices into component matrices, where at least one component matrix represents typical properties of these matrices and at least one other component matrix represents atypical properties of the matrices;
generating a new temporal dependency matrix based on new network traffic; and
detecting anomalous behavior in the new network traffic by comparing component matrices of the new temporal dependency matrix with component matrices of the temporal dependency matrices under normal operating conditions.

### Claim 21 (depends on 20)

The computer implemented method as set forth in claim 20, wherein temporal dependency matrix representative of temporal dependency between different message types in the network traffic is a Transfer Entropy Matrix (TEM) produced using Transfer Entropy calculations.

### Claim 22 (depends on 20)

The computer implemented method as set forth in claim 20, wherein decomposing sets of temporal dependency matrices into component matrices is performed using sparse low-rank decomposition.

### Claim 23 (depends on 20)

The computer implemented method as set forth in claim 20, wherein detecting anomalous behavior in the new network traffic is performed by first performing sparse low-rank decomposition of individual Transfer Entropy matrices (TEM) and then comparing an 1 norm of a sparse component, ∥zS∥1 with a mean of a training set norm.

### Claim 24 (depends on 20)

The computer implemented method as set forth in claim 20, wherein detecting anomalous behavior in the new network traffic further comprises determining a norm and standard deviation from sparse low-rank decompositions of multiple Transfer Entropy matrices (TEMs) and performing a t-test to determine when the new network traffic exceeds a pre-set bound.

### Claim 25 (depends on 20)

The computer implemented method as set forth in claim 20, wherein upon detecting anomalous behavior in the new network traffic, further comprising an operation of initiating a reactive response.

### Claim 26 (depends on 25)

The computer implemented method as set forth in claim 25, wherein the reactive response includes causing a vehicle to initiate a safe-mode, where at least one vehicle system is disabled.