Network anomaly detection
AssigneeFleet Defender, Inc.
InventorsTerry Reinert, Tanner Sorensen
Life of this patent
Estimating the term…
Abstract
An anomaly detector of a Controller Area Network (CAN) bus performs analysis on messages received from the CAN bus to determine if the messages are anomalous. The anomaly detector may be implemented on a vehicle by an Electronic Control Unit (ECU). The anomaly detector may extract a batch of feature vectors for binary messages received from the CAN bus. The anomaly detector then performs a model adaption to adapt a previous probability model with the batch of feature vectors. The adapted probability model is then compared with a universal background model to determine a network anomaly level.
Claims20
A method of anomaly detection, the method comprising:
- receiving a plurality of binary messages from a network bus;
- generating a current batch of a plurality of feature vectors, each of the plurality of feature vectors determined based on the plurality of binary messages;
- determining a current probability model by adapting a previous probability model with the current batch of the plurality of feature vectors;
- and
- comparing the current probability model with a universal background model to determine a network anomaly level, wherein the universal background model provides a probability distribution of the plurality of feature vectors under typical network conditions.
An anomaly detector for a network bus, the anomaly detector comprising:
- a communication interface configured to receive a plurality of binary messages from the network bus;
- and
- a memory configured to store program instructions and the plurality of binary messages received by the communication interface;
- and
- a processor configured to execute the program instructions stored in the memory that, when executed by the processor, cause the processor to:
- generate a current batch of a plurality of feature vectors, wherein each of the plurality of feature vectors are determined based on the plurality of binary messages;
- determine a current probability model by adapting a previous probability model with the current batch of the plurality of feature vectors;
- and
- compare the current probability model with a universal background model to determine a network anomaly level, wherein the universal background model provides a probability distribution of the plurality of feature vectors under typical network conditions.
An anomaly detection system comprising:
- a plurality of vehicles, each of the plurality of vehicles comprising:
- at least one network bus;
- a plurality of nodes communicatively coupled by the at least one network bus, wherein at least one node of the plurality of nodes is configured to transmit a plurality of binary messages by way of the area network bus;
- at least one anomaly detector for the at least one network bus, the at least one anomaly detector comprising:
- a communication interface configured to receive the plurality of binary messages from the at least one network bus;
- a memory configured to store program instructions and the plurality of binary messages received by the communication interface;
- and
- a processor configured to execute the program instructions stored in the memory that, when executed by the processor, cause the processor to:
- generate a current batch of a plurality of feature vectors based on the plurality of binary messages;
- determine a current probability model by adapting a previous probability model with the current batch of the plurality of feature vectors;
- and
- compare the current probability model with a universal background model to determine a network anomaly level, wherein the universal background model provides a probability distribution of the plurality of feature vectors under typical network conditions;
- and
- a server communicatively coupled to the plurality of vehicles, wherein the server is configured to receive the network anomaly level from each of the plurality
- of vehicles, wherein the server is configured to fuse the network anomaly level from each of the plurality of vehicles to determine a fleet anomaly level.
Dependencies are inferred from the claim text.