System and method for time based anomaly detection in an in-vehicle communication network
AssigneeArgus Cyber Security Ltd.
InventorsYaron Galula, Ofer Ben-Noon, Oron Lavi, Ofer Kapota, Alexei Kovelman
Life of this patent
Estimating the term…
Abstract
A system and method for providing security to a network may include maintaining, by a processor, a model of an expected behavior of data communications over the in-vehicle communication network; receiving, by the processor, a message sent over the network; determining, by the controller, based on the model and based on a timing attribute of the message, whether or not the message complies with the model; and if the message does not comply with the model then performing, by the processor, at least one action related to the message.
Claims17
A system including a non-transitory computer readable medium including instructions that, when executed by at least one processor, cause the at least one processor to perform timing-based cyber-security operations, the operations including:
- maintaining a timing model of an expected behavior of data communications over an in-vehicle communication network;
- receiving a plurality of messages communicated over the network;
- determining, based on:
- monitoring time lapses related to the plurality of messages having a message ID value,
- calculating an average time lapse for a message ID value, and
- relating the average time lapse to a threshold included in the timing model
- whether or not at least one of the messages is related to an anomaly;
- and
- if at least one message is related to an anomaly then performing, by the processor, at least one action related to the message;
- wherein the action is at least one of:
- disabling a component connected to the network, activating a component connected to the network, blocking a message, delaying a message, limiting a frequency of a message type, logging a message, and alerting.
A method comprising:
- maintaining, by a processor, a timing model of an expected behavior of data communications over the in-vehicle communication network;
- receiving, by the processor, a plurality of messages sent over the network;
- determining, by the controller, based on:
- monitoring time lapses related to the plurality of messages having a message ID value;
- calculating an average time lapse for a message ID value;
- and
- based on relating the average time lapse to a threshold included in the timing model,
- whether or not at least one of the messages related to an anomaly;
- and
- if the message does not comply with the timing model then performing, by the processor, at least one action related to the message;
- wherein the action is at least one of:
- disabling a component connected to the network, activating a component connected to the network, blocking a message, delaying a message, limiting a frequency of a message type, logging a message, and alerting.
The method of 10, comprising:
- determining a context related to at least one of:
- the vehicle, the network, and a node connected to the network;
- and
- determining whether or not a message complies with the timing model based on the context.
The method of 10, comprising:
- identifying an event related to at least one of:
- the vehicle, the network, and a node connected to the network;
- and
- determining whether or not a message complies with the timing model based on the event.
The method of 10, wherein the at least one action related to the message includes isolating a portion of the network from the rest of the in-vehicle communication network in order to isolate a source of a message related to an anomaly.
The method of 10, comprising:
- determining whether or not a component connected to in-vehicle communication network is malfunctioning based on one or more messages;
- and
- generating an indication related to the malfunctioning component.
The method of 10, comprising:
- calculating a confidence level of a message being related to an anomaly;
- and
- wherein performing the action is based on the confidence level.
A method for enforcing security in a communication network, the method comprising:
- maintaining, by a processor, a timing model related to messages communicated on the network;
- receiving a first message and a second message communicated on the network;
- determining, based on:
- monitoring time lapses related to the plurality of messages having a message ID value,
- calculating an average time lapse for a message ID value, and
- relating the average time lapse to a threshold included in the timing model,
- whether or not at least one of the first and second messages is related to an anomaly;
- and
- if at least one of the first and second messages is related to an anomaly then performing at least one action related to the messages;
- wherein the action is at least one of:
- disabling a component connected to the network, activating a component connected to the network, blocking a message, delaying a message, limiting a frequency of a message type, logging a message, and alerting.
Dependencies are inferred from the claim text.