Securing intra-vehicle communications via a controller area network bus system based on behavioral statistical analysis

A method comprising:

• receiving, by one or more processors associated with an internal firewall node of a plurality of nodes coupled with a Controller Area Network (CAN) bus of a connected car, a data frame broadcast from a source node of the plurality of nodes;
• extracting, by the one or more processors, information from the data frame;
• analyzing coherence between the extracted information and historical information observed by the internal firewall node;
• and
• responsive to a result of said analyzing coherence indicating the data frame is valid, updating, by the one or more processors, the historical information based on the data frame, wherein said analyzing coherence comprises analyzing coherence between the extracted information and a combination of (i) a current status of an environment in which the connected car is operating based on a current database and (ii) a status of the source node, using a local behavior database, wherein the current database includes historical information regarding one or more of (a) an identify of neighboring vehicles in proximity to the connected car, (b) a status of a road on which the connected car is driving, and (c) respective status associated with the neighboring vehicles within a predetermined amount of time, and wherein the local behavior database includes historical information regarding a sequence of communications observed by the receiving node;
• responsive to the result of said analyzing coherence indicating the data frame is invalid, causing one or more intended recipients of the data frame of the plurality of nodes to drop the data frame, by broadcasting a high priority warning notification data frame on the CAN bus.

A non-transitory computer-readable storage medium embodying a set of instructions, which when executed by one or more processors of a receiving node of a plurality of nodes coupled with a Controller Area Network (CAN) bus of a connected car, causes the one or more processors to perform a method comprising:

• receiving, by the receiving node, a data frame broadcast from a source node of the plurality of nodes;
• making a first determination whether the receiving node is the intended recipient of the data frame;
• responsive to said first determination being affirmative:
• making a second determination whether an internal firewall node of the plurality of nodes has identified the data frame as a potentially malicious data frame;
• and
• responsive to said second determination being affirmative, dropping the data frame and discontinuing processing of the data frame;
• responsive to said first determination being negative or said second determination being negative, extracting information from the data frame;
• analyzing coherence between the extracted information and historical information observed by the receiving node, wherein said analyzing coherence comprises analyzing coherence between the extracted information and a combination of (i) a current status of an environment in which the connected car is operating based on a current database and (ii) a status of the source node, using a local behavior database, wherein the current database includes historical information regarding one or more of (a) an identify of neighboring vehicles in proximity to the connected car, and (b) respective status associated with the neighboring vehicles within a predetermined amount of time, and wherein the local behavior database includes historical information regarding a sequence of communications observed by the receiving node;
• and
• responsive to a result of said analyzing coherence indicating the data frame is valid, updating the historical information based on the data frame, otherwise discarding the data frame.

A non-transitory computer-readable storage medium embodying a set of instructions, which when executed by one or more processors of an internal firewall node of a plurality of nodes coupled with a Controller Area Network (CAN) bus of a connected car, causes the one or more processors to perform a method comprising:

• receiving a data frame broadcast from a source node of the plurality of nodes;
• extracting information from the data frame;
• analyzing coherence between the extracted information and historical information observed by the internal firewall node;
• and
• responsive to a result of said analyzing coherence indicating the data frame is valid, updating, by the one or more processors, the historical information based on the data frame, wherein said analyzing coherence comprises analyzing coherence between the extracted information and a combination of (i) a current status of an environment in which the connected car is operating based on a current database and (ii) a status of the source node, using a local behavior database, wherein the current database includes historical information regarding one or more of (a) an identify of neighboring vehicles in proximity to the connected car, and (b) respective status associated with the neighboring vehicles within a predetermined amount of time, and wherein the local behavior database includes historical information regarding a sequence of communications observed by the receiving node;
• responsive to the result of said analyzing coherence indicating the data frame is invalid, causing one or more intended recipients of the data frame of the plurality of nodes to drop the data frame, by broadcasting a high priority warning notification data frame on the CAN bus.