# US 10,771,346 B2 · Method for monitoring a network for anomalies

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,771,346 B2
- Document ID: US10771346B2
- Status: Granted
- Kind: B2
- Application number: 16/341,254
- Filed: 2017-03-22
- Published: 2020-02-06
- Granted: 2020-09-08
- Earliest claimed: 2016-10-11
- Assignees: Conti Temic microelectronic GmbH
- Applicants: Conti Temic Microelectronic GmbH
- Inventors: Uli Joos; Florian Gerster; Lorenz Lieder
- Web page: https://patentgrep.com/patent/US10771346B2

## CPC

- H04L 41/06: Management of faults, events, alarms or notifications
- H04L 41/142: using statistical or mathematical methods
- H04J 3/0635: {Clock or time synchronisation in a network (timer in protocols H04L69/28)}
- H04J 3/0641: {Change of the master or reference, e.g. take-over or failure of the master}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- H04J: MULTIPLEX COMMUNICATION (transmission in general H04B; peculiar to transmission of digital information H04L5/00; systems for the simultaneous or sequential transmission of more than one television signal H04N7/08; in exchanges H04Q11/00; stereophonic systems H04S)

## Abstract

A method monitors a data transmission network having a plurality of devices connected to one another over fixedly prescribed signal transmission paths, for anomalies. One of the devices is a master device that has a counter and a trigger apparatus, by which a prescribed signal feature of a signal is acquired, and upon the acquisition, a master counter state corresponding thereto is read. The method provides for an evaluation apparatus to determine, under predetermined conditions, a setpoint value of at least one network-specific parameter defined by a physical property of the network, before an actual value of the network-specific parameter is determined from a difference between the master counter state and a further counter state, and an anomaly is indicated if a predetermined deviation criterion between the actual value and the setpoint value is met.

## Claims

### Claim 1

A method for monitoring a network for anomalies, the network provided for data transmission and having a plurality of devices connected to one another overfixedly prescribed signal transmission paths, which comprises the steps of:
assigning one of the devices to be a master device having a counter and a trigger apparatus, and by said master device a prescribed signal feature of a signal transmitted via the network is acquired;
reading, upon acquisition of the prescribed signal feature, a master counter state of the counter of the master device, corresponding to a time of the acquisition;
determining via an evaluation apparatus, under predetermined anomaly-free conditions, a setpoint value of at least one network-specific parameter defined by a physical property of the network, wherein a frequency difference between a frequency of a clock generator of an actual source device, from which the signal was transmitted, and a clock generator of the master device, coupled to the counter of the master device, forms the network-specific parameter;
determining a respective actual value of the at least one network-specific parameter by the evaluation apparatus from a difference between a read master counter state and a further counter state;
indicating an anomaly if a predetermined deviation criterion between the respective actual value and the setpoint value is met;
additionally acquiring a second prescribed signal feature of the signal by the trigger apparatus of the master device;
reading a second master counter state, corresponding to a time of an acquisition of the second prescribed signal feature, wherein the actual value of the frequency difference is determined on a basis of a difference between the master counter state and the second master counter state and taking into account a prescribed data transmission rate and/or network clock frequency used in the network and/or a communication protocol used in the network and/or a type of modulation used in the network;
calculating a relative frequency deviation as
Δfrel=ΔCX/ΔCXMM,
wherein
ΔCX indicates a number of cycles awaited by the actual source device between the transmission of the first and second prescribed signal features; and
ΔCXMM indicates the difference between the master counter state and the second master counter state.

### Claim 2 (depends on 1)

The method according to claim 1, wherein:
a propagation time pattern of the signal in the network constitutes the at least one network-specific parameter and it is provided, for determining an actual value;
one of the devices of the network is a client device that has a counter and a trigger apparatus;
the signal is transmitted via the network both to the master device and to the client device; and
the prescribed signal feature to be acquired by the trigger apparatus of the client device and a client counter state, corresponding to a time of an acquisition, of the counter of the client device to be read, wherein an actual value of the propagation time pattern is determined on a basis of the client counter state, which serves as the further counter state.

### Claim 3 (depends on 2)

The method according to claim 2, which further comprises:
transmitting a reference signal from the client device to the master device in which a read reference client counter state corresponding to a sending time of a prescribed signal feature of the reference signal is transmitted to the master device;
acquiring the prescribed signal feature of the reference signal by the trigger apparatus of the master device and reading a reference master counter state, corresponding to a time of an acquisition of the prescribed signal feature of the reference signal; and
using the reference client counter state and the reference master counter state to determine the actual value of a propagation time pattern.

### Claim 4 (depends on 3)

The method according to claim 3, which further comprises calculating the actual value of the propagation time pattern PAT of the signal by:
PAT=[CXM−CXC]−[CRM−CRC]=[CXM−CRM]−[CXC−CRC],
wherein:
CXM indicates the master counter state corresponding to the prescribed signal feature;
CXC indicates the client counter state corresponding t the prescribed signal feature;
CRM indicates the reference master counter state; and
CRC indicates the reference client counter state.

### Claim 5 (depends on 2)

The method according to claim 2, which further comprises:
additionally determining the actual value of the propagation time pattern by a client-side part of the evaluation apparatus that is configured so as to perform own calculations; and
indicating the anomaly if the deviation criterion between a respective determined actual value and the setpoint value is recognized as being met by the evaluation apparatus and/or by the client-side part of the evaluation apparatus.

### Claim 6 (depends on 1)

The method according to claim 1, which further comprises recognizing the anomaly in the network if the actual source device simulates being another purported source device of the network; and wherein in a check as to whether the deviation criterion is met, the evaluation apparatus takes into account a temperature, acquired by way of a respective temperature sensor, of the master device and of the another purported source device.

### Claim 7 (depends on 1)

The method according to claim 1, which further comprises determining the master counter state corresponding to the prescribed signal feature, in order to improve a resolution, by way of an interpolating measurement method.

### Claim 8 (depends on 1)

The method according to claim 1, wherein the master device has a selection logic unit, by way of which the signal feature is selected and/or prescribed automatically.

### Claim 9 (depends on 1)

The method according to claim 1, which further comprises determining the master counter state corresponding to the prescribed signal feature, in order to improve a resolution, by way of an interpolating measurement method performed by a time-to-digital converter.

### Claim 10 (depends on 1)

The method according to claim 1, wherein the master device has a selection logic unit, by way of which the signal feature is selected and/or prescribed automatically, depending on a line code used in the network and/or a type of modulation used in the network.