Method for protection from cyber attacks to a vehicle, and corresponding device

A method for protection from cyber attacks in a communication network of a vehicle having a communication bus including a high bus line, on which high logic voltages pass, and a low bus line, on which low logic voltages pass;

• a plurality of nodes associated with the communication bus in a signal-exchange relationship and associated at least in part to control units for controlling functions of the vehicle,
• where the nodes exchange messages passing between nodes of the plurality of nodes, and the messages are coded in data frames through dominant and recessive bits,
• said method including the steps of:
• acquiring dominant voltage measurements;
• and
• obtaining an electrical characteristic corresponding to a voltage profile (VP) of nodes that transmit messages, by acquiring consecutive groups (k) of voltage measurements (VL) of dominant voltage measurements (NVi,k) on the high bus line (10H) and on the low bus line (10L) during reception of messages (M) at receiving nodes and calculating a distribution thereof;
• calculating values of distribution statistics;
• calculating a cumulative voltage deviation for each value of statistic;
• and
• obtaining a voltage profile (VP) representing a straight line by adding the cumulative voltage deviations of each statistic;
• executing a malicious-node detection procedure that comprises:
• extracting at least one characteristic parameter of said voltage profile for each group, said characteristic parameter being the slope (m) of the straight line representing the voltage profile or a constant value (q) of the straight line representing the voltage profile;
• comparing, over said consecutive groups (k) of voltage measurements (VL), said at least one characteristic parameter of a current group of voltage measurements with a corresponding characteristic parameter extracted from a previous group of voltage measurements;
• and
• if said comparison operation indicates that said at least one characteristic parameter of the current group differs from the at least one characteristic parameter of the previous group by at least one given difference value, supplying an identifier of the corresponding message and calculating a settling time (kst) which is a time of settling of the at least one characteristic parameter on a constant value over said consecutive groups (k) of voltage measurements (VL),
• executing a transmitting-node identification procedure, which includes:
• comparing said at least one characteristic parameter evaluated at the settling time against all the corresponding characteristic parameters of all the messages received up to said settling time (Kst), said identification procedure comprising:
• defining, for each of said messages received, a range of variation of said at least one characteristic parameter with respect to a given number of previous samples, previous with respect to the settling time (Kst);
• and
• evaluating whether the value of said at least one characteristic parameter falls within the range of variation of one of said messages and, if so, identifying as malicious node the node that transmits said message, and after determining the malicious node, taking necessary measures including at least applying a security patch to the malicious node.