# US 12,118,080 B2 · Anomaly detection for vehicular networks for intrusion and malfunction detection

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,118,080 B2
- Document ID: US12118080B2
- Status: Granted
- Kind: B2
- Application number: 16/556,883
- Filed: 2019-08-30
- Published: 2019-12-26
- Granted: 2024-10-15
- Earliest claimed: 2014-12-30
- Assignees: Battelle Memorial Institute
- Applicants: Battelle Memorial Institute
- Inventors: Brad Harris; Anuja Sonalker; Kevin Mayhew
- Web page: https://patentgrep.com/patent/US12118080B2

## CPC

- G06F 21/554: {involving event detection and direct action}
- G06N 20/00: Machine learning
- G06N 20/10: using kernel methods, e.g. support vector machines [SVM]
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS

## Abstract

A security monitoring system for a Controller Area Network (CAN) comprises an Electronic Control Unit (ECU) operatively connected to the CAN bus. The ECU is programmed to classify a message read from the CAN bus as either normal or anomalous using an SVM-based classifier with a Radial Basis Function (RBF) kernel. The classifying includes computing a hyperplane curvature parameter γ of the RBF kernel as γ=ƒ(D) where ƒ( ) denotes a function and D denotes CAN bus message density as a function of time. In some such embodiments γ=ƒ(Var(D)) where Var(D) denotes the variance of the CAN bus message density as a function of time. The security monitoring system may be installed in a vehicle (e.g. automobile, truck, watercraft, aircraft) including a vehicle CAN bus, with the ECU operatively connected to the vehicle CAN bus to read messages communicated on the CAN bus.

## Claims

### Claim 1

A Support Vector Machine (SVM) classifier training system comprising:
a computer programmed to train a Support Vector Machine (SVM) one-class classifier using a Radial Basis Function (RBF) kernel to perform anomaly monitoring of a controller area network (CAN) bus employing a message-based communication protocol by operations including:
receiving a training set comprising vectors with associated times representing CAN bus messages;
calculating a hyperplane curvature parameter (γ) functionally dependent on CAN bus message density in time; and
training the SVM one-class classifier on the training set using the calculated hyperplane curvature parameter (γ).

### Claim 2 (depends on 1)

The SVM classifier training system of claim 1 wherein the operations further include:
determining a hyperplane granularity parameter (ε) by repeating the training for a grid of candidate hyperplane granularity parameter (ε) values using a grid search.

### Claim 3 (depends on 1)

The SVM classifier training system of claim 1 wherein the computer comprises a cloud-based computing resource, a parallel processor system, or a cluster computer.

### Claim 4 (depends on 1)

The SVM classifier training system of claim 1 wherein the RBF kernel is a kernel K calculated using the equation:
K(xi−xj)=e−γ∥xixj)∥2 where x∈ and γ>0
where is the set of all real numbers, γ represents the curvature of the hyperplane, and xi and xj are features of the training set.

### Claim 5 (depends on 1)

The SVM classifier training system of claim 1 wherein γ=ƒ(D) where ƒ( ) denotes a function and D denotes CAN bus message density in time.

### Claim 6 (depends on 1)

The SVM classifier training system of claim 1 wherein γ=ƒ(√{square root over (Var(D))}) where ƒ( ) denotes a function and D denotes CAN bus message density in time and Var(D) denotes variance of the CAN bus message density in time.

### Claim 7 (depends on 1)

The SVM classifier training system of claim 1 wherein the data set contains only normal messages of a CAN bus and the training comprises training the SVM one-class classifier to minimize one of (i) false positives and (ii) false negatives.

### Claim 8 (depends on 1)

The SVM classifier training system of claim 1 wherein the operations further comprise:
setting a tuning parameter ν specifying a minimum number of Support Vectors to 520.

### Claim 9 (depends on 1)

The SVM classifier training system of claim 1 wherein the computer is further programed to:
receive at least one additional training subset; and
repeat the operations performed on the training set on the at least one additional training subset.

### Claim 10 (depends on 1)

The SVM classifier training system of claim 1 wherein the training set comprises CAN bus messages acquired over at least one time interval from a vehicle, and the computer is further programmed to:
generate an SVM-based anomaly detector configured to execute on a vehicle-grade Electronic Control Unit (ECU) based on the trained SVM one-class classifier.

### Claim 11 (depends on 10)

The SVM classifier training system of claim 10 wherein the operation of generating the SVM-based anomaly detector configured to execute on a vehicle-grade ECU comprises:
replacing the calculated hyperplane curvature parameter (γ) with a resource-constrained-hardware-compatible hyperplane curvature parameter (γ).

### Claim 12

A system comprising:
a Support Vector Machine (SVM) classifier training system comprising a computer programmed to train an SVM one-class classifier using a Radial Basis Function (RBF) kernel to perform anomaly monitoring of a controller area network (CAN) bus employing a message-based communication protocol by operations including receiving a training set comprising vectors with associated times representing CAN bus messages, calculating a hyperplane curvature parameter (γ) functionally dependent on CAN bus message density in time; and training the SVM one-class classifier on the training set using the calculated hyperplane curvature parameter (γ)
a vehicle including a vehicle CAN bus employing a message-based communication protocol, and an electronic control unit (ECU) installed on the vehicle CAN bus and including a microprocessor or microcontroller and an ECU transceiver, the ECU programmed to execute an anomaly detector comprising a trained SVM one-class classifier configured by receiving information from the SVM classifier training system.

### Claim 13 (depends on 12)

The system of claim 12, wherein:
the anomaly detector further comprises an unseen ID unit that receives a message from the ECU transceiver and:
if the unseen ID unit determines that the message is not on an observed ID list, the unseen ID unit outputs a binary indicator indicating that message is not on the observed ID list; and
if the unseen ID unit determines that the message is on the observed ID list, the unseen ID unit outputs the message to the trained SVM one-class classifier.

### Claim 14

An anomaly monitoring system for a Controller Area Network (CAN) comprising an Electronic Control Unit (ECU) operatively connected to a CAN bus to read messages communicated on the CAN bus, the ECU programmed to perform an anomaly monitoring method comprising:
classifying a message read from the CAN bus as either normal or anomalous using an SVM-based classifier with a Radial Basis Function (RBF) kernel;
wherein the classifying includes computing a hyperplane curvature parameter γ of the RBF kernel as γ=ƒ(D) where ƒ( ) denotes a function and D denotes CAN bus message density as a function of time.

### Claim 15 (depends on 14)

The anomaly monitoring system of claim 14 wherein:
the classifying includes computing the hyperplane curvature parameter γ of the RBF kernel as γ=ƒ(√{square root over (Var(D))}) where Var(D) denotes a variance of the CAN bus message density as a function of time.

### Claim 16 (depends on 14)

The anomaly monitoring system of claim 14 wherein the anomaly monitoring method further comprises:
comparing the arbitration identifier (ID) of a message read from the CAN bus against a list of arbitration IDs, wherein the message is either (1) classified as anomalous if the arbitration ID of the message is not contained in the list of arbitration IDs or (2) passed to the classifying operation using the SVM-based classifier with the RBF kernel if the arbitration ID of the message is contained in the list of arbitration IDs.

### Claim 17 (depends on 14)

A vehicle comprising:
an automobile, truck, watercraft, or aircraft including a vehicle Controller Area Network (CAN) bus; and
an anomaly monitoring system as set forth in claim 14 comprising an Electronic Control Unit (ECU) operatively connected to the vehicle CAN bus to read messages communicated on the CAN bus.

### Claim 18 (depends on 14)

The anomaly monitoring system of claim 14 wherein ƒ(D) comprises a spreading metric measuring a spread of the CAN bus message density D.

### Claim 19 (depends on 14)

The anomaly monitoring system of claim 14 wherein ƒ(D) comprises an inverse of a spreading metric measuring a spread of the CAN bus message density D.

### Claim 20 (depends on 12)

The system of claim 12 wherein γ=ƒ(D) where ƒ( ) denotes a function and D denotes CAN bus message density in time.