System and method for content based anomaly detection in an in-vehicle communication network
AssigneeArgus Cyber Security Ltd.
InventorsYaron Galula, Ofer Ben-Noon, Oron Lavi, Alexei Kovelman, Ofer Kapota
Life of this patent
Estimating the term…
Abstract
A system and method for providing security to a network may include maintaining, by a processor, a model of an expected behavior of data communications over an in-vehicle communication network; receiving, by the processor, a plurality of messages communicated over the network; determining, by the processor, based on the model and based on content attributes of the plurality of messages, whether or not at least one of the messages complies with the model; and if at least one message does not comply with the model then performing, by the processor, at least one action related to the message.
Claims19
A system including a non-transitory computer readable medium including instructions that, when executed by at least one computer hardware processor, cause the at least one hardware processor to perform content-based cyber-security operations, the operations including:
- maintaining a content model of an expected behavior of data communications over an in-vehicle communication network;
- receiving first and second messages communicated over the network, wherein the first and second messages include the same identification (ID) value and each includes a signal;
- determining, based on the ID value and based on first and second counter values respectively included in the first and second messages whether or not the first and second messages comply with the expected behavior, wherein the first and second counter values are expected to be sequential;
- and
- if incompliance is detected then determining at least one of the messages was sent by a malicious entity and performing, by the processor, at least one action related to the at least one message;
- wherein the action is at least one of:
- disabling a component connected to the network, activating a component connected to the network, blocking a message, delaying a message, limiting a frequency of a message type, disconnecting a node from the in-vehicle communication network, alerting and isolating a portion of the network from the rest of the in-vehicle communication network.
A method comprising:
- maintaining, by a computer hardware processor, a content model of an expected behavior of data communications over an in-vehicle communication network;
- receiving, by the processor, first and second messages communicated over the network, wherein the first and second messages include the same identification (ID) value and each includes a signal;
- determining, by the processor, based on the ID value and based on first and second counter values respectively included in the first and second messages, whether or not the first and second messages comply with the expected behavior, wherein the first and second counter values are expected to be sequential;
- and
- if incompliance is detected then determining at least one of the messages was sent by a malicious entity and performing, by the processor, at least one action related to the at least one message;
- wherein the action is at least one of:
- disabling a component connected to the network, activating a component connected to the network, blocking a message, delaying a message, limiting a frequency of a message type, disconnecting a node from the in-vehicle communication network, alerting and isolating a portion of the network from the rest of the in-vehicle communication network.
Dependencies are inferred from the claim text.