System and method for content based anomaly detection in an in-vehicle communication network
AssigneeArgus Cyber Security Ltd.
InventorsYaron Galula, Ofer Ben-Noon, Oron Lavi
Life of this patent
Estimating the term…
Abstract
A system and method for providing security to a network may include maintaining, by a processor, a model of an expected behavior of data communications over the in-vehicle communication network; receiving, by the processor, a message sent over the network; determining, by the processor, based on the model and based on content in the message, whether or not the message complies with the model; and if the message does not comply with the model then performing, by the processor, at least one action related to the message.
Claims17
A system including a non-transitory computer readable medium including instructions that, when executed by at least one computer hardware processor, cause the at least one computer hardware processor to perform content-based cyber-security operations, the operations including:
- maintaining a content model of an expected behavior of data communications over an in-vehicle communication network included in a vehicle;
- receiving first and second messages communicated over the in-vehicle communication network, wherein the first and second messages include the same identification (ID) value;
- if a difference between first and second values respectively included in the first and second messages is greater than a threshold included in the content model, then determining at least one of the messages is related to malicious activity, wherein the values are provided by one or more components connected to the in-vehicle network;
- and
- if determining at least one message is related to malicious activity, then performing, by the processor, at least one action including selectively logging a message communicated over the in-vehicle network.
A method comprising:
- maintaining, by a processor, a content model of an expected behavior of data communications over an in-vehicle communication network included in a vehicle;
- receiving, by the processor, first and second messages communicated over the in-vehicle communication network, wherein the first and second messages include the same identification (ID) value;
- if a difference between first and second values respectively included in the first and second messages is greater than a threshold included in the content model then determining, by the processor, at least one of the messages is related to malicious activity, wherein the values are provided by one or more components connected to the in-vehicle network;
- and
- if determining at least one message is related to malicious activity then performing, by the processor, at least one action including selectively logging a message communicated over the in-vehicle network.
Dependencies are inferred from the claim text.