CAN bus protection systems and methods

An electronic device comprising:

• an electronic processor communicatively coupled with a Controller Area Network (CAN) bus;
• and
• a non-transitory storage medium storing (i) one or more machine language instruction sets wherein each machine language instruction set comprises a set of opcodes and (ii) instructions read and executed by the electronic processor to perform a CAN bus security method including:
• extracting a transport protocol (TP) signal comprising data bytes of a plurality of messages conforming with a CAN-TP protocol from CAN bus message traffic on the CAN bus;
• for each machine language instruction set of the one or more machine language instruction sets, determining a fraction of the TP signal that matches opcodes of the machine language instruction set;
• and
• detecting an anomaly based at least in part on at least one of the determined fractions exceeding an opcode anomaly threshold,
• wherein detecting the anomaly further comprises performing byte rotation on bytes of the TP signal before matching the TP signal with opcodes of the machine language instruction set.

A non-transitory storage medium storing instructions read and executed by at least one electronic processor to perform a CAN bus signal format inference method comprising:

• extracting candidate signals from training CAN bus message traffic wherein each candidate signal is a time sequence of repetitions of an ordered group of data bits in the CAN bus message traffic wherein the ordered group of data bits is delineated by one or more message headers;
• defining one or more signals wherein each signal is a candidate signal that matches structural characteristics of a matching data type and the each signal is assigned the matching data type;
• generating an inferred CAN bus protocol with which the defined one or more signals conform;
• generating a descriptor file representing an inferred CAN bus signal format with which the defined one or more signals conform;
• extracting a signal from CAN bus message traffic on a CAN bus wherein the extracted signal conforms with the inferred CAN bus protocol;
• detecting an anomaly in the extracted signal;
• and
• generating an alert indicating the detected anomaly.