Device and method for anomaly detection in a communications network
AssigneeRobert Bosch GmbH
InventorsAndreas Weber, Janin Wolfinger, Jens Gramm, Michael Herrmann
Life of this patent
Estimating the term…
Abstract
A device and a method for anomaly detection in a communications network, at least two messages at a port of the communications network being observed, a property of a communication behavior of a network user being determined as a function of the at least two messages, a deviation of the property from an expected property being determined, and the presence of an anomaly being detected when the deviation differs from an allowable deviation. The expected property defines a communication behavior of the at least one network user as a function of an in particular static network architecture of the communications network.
Claims14
A method for anomaly detection in an automotive communications network of a vehicle, the method comprising the following steps:
- observing at least two messages at a port of the automotive communications network;
- determining a property of a communication behavior of a network user as a function of the at least two messages, the network user including a first control unit of the automotive communications network;
- determining a deviation of the property from an expected property, wherein the expected property is determined based on a model that models a communication behavior between the network user and a second network user, the second network user including a second control unit of the automotive communications network, the expected property being a function of a static network architecture of the automotive communications network including the first control unit and the second control unit;
- and
- detecting a presence of an anomaly based on the deviation differing from an allowable deviation,
- wherein during the anomaly detection, a distinction is made between various system states in which the vehicle can potentially be in, the system states including (i) ignition on, (ii) engine idling, (iii) forward travel, (iv) reverse travel, and (v) vehicle diagnostics on;
- a system state of the vehicle being determined, and at least one of the expected property or the allowable deviation being determined as a function of the determined system state.
A device for anomaly detection in an automotive communications network of a vehicle, the device comprising:
- a port;
- and
- a processing unit configured to:
- observe at least two messages at the port;
- determine a property of a communication behavior of a network user as a function of the at least two messages, the network user including a first control unit of the automotive communications network;
- determine a deviation of the property from an expected property, wherein the expected property is determined based on a model that models a communication behavior between the network user and a second network user, the second network user including a second control unit of the automotive communications network, the expected property being a function of a static network architecture of the automotive communications network including the first control unit and the second control unit;
- and
- detect a presence of an anomaly based on the deviation differing from an allowable deviation,
- wherein during the anomaly detection, a distinction is made between various system states in which the vehicle can potentially be in, the system states including (i) ignition on, (ii) engine idling, (iii) forward travel, (iv) reverse travel, and (v) vehicle diagnostics on;
- a system state of the vehicle being determined, and at least one of the expected property or the allowable deviation being determined as a function of the determined system state.
A non-transitory computer-readable memory medium on which is stored a computer program for anomaly detection in an automotive communications network of a vehicle, the computer program, when executed by a computer, causing the computer to perform the following steps:
- observing at least two messages at a port of the automotive communications network;
- determining a property of a communication behavior of a network user as a function of the at least two messages, the network user including a first control unit of the automotive communications network;
- determining a deviation of the property from an expected property, wherein the expected property is determined based on a model that models a communication behavior between the network user and a second network user, the second network user including a second control unit of the automotive communications network, the expected property being a function of a static network architecture of the automotive communications network including the first control unit and the second control unit;
- and
- detecting a presence of an anomaly based on the deviation differing from an allowable deviation,
- wherein during the anomaly detection, a distinction is made between various system states in which the vehicle can potentially be in, the system states including (i) ignition on, (ii) engine idling, (iii) forward travel, (iv) reverse travel, and (v) vehicle diagnostics on;
- a system state of the vehicle being determined, and at least one of the expected property or the allowable deviation being determined as a function of the determined system state.
Dependencies are inferred from the claim text.