System and method for consistency based anomaly detection in an in-vehicle communication network
AssigneeArgus Cyber Security Ltd.
InventorsYaron GALULA, Ofer BEN-NOON, Ofer KAPOTA, Alexei KOVELMAN
Life of this patent
Estimating the term…
Abstract
A system and method for providing security to a network may include monitoring, by a processor, traffic on a first and second network portions of an in-vehicle communication network; determining whether or not a first message detected on the first network portion is anomalous based on at least one of: an attribute of a second message detected on the second network portion and an absence of a second message from the second network portion over a predefined time period; and, if it is determined the first message is anomalous then performing at least one action.
Claims20
A system including a non-transitory computer readable medium including instructions that, when executed by at least one processor, cause the at least one processor to perform security operations, the operations comprising:
- monitoring traffic on a first and second network portions of an in-vehicle communication network;
- determining whether or not a first message detected on the first network portion is anomalous based on at least one of:
- an attribute of a second message detected on the second network portion and an absence of a second message from the second network portion over a predefined time period;
- and
- if it is determined the first message is anomalous then performing at least one action.
A method comprising:
- monitoring, by a processor, traffic on a first and second network portions of an in-vehicle communication network;
- determining, by the processor, whether or not a first message detected on the first network portion is anomalous based on at least one of:
- an attribute of a second message detected on the second network portion and an absence of a second message from the second network portion over a predefined time period;
- and
- if it is determined the first message is anomalous then performing, by the processor, at least one action.
A method comprising:
- examining, by a processor, at least a first message received from a first network and a second message received from a second network;
- determining, by the processor, whether or not at least one of the first and second messages are related to an anomaly based on relating an attribute of the first message to an attribute of the second message;
- and
- if it is determined that at least one of the first and second messages is related to an anomaly then performing, by the processor, at least one action.
Dependencies are inferred from the claim text.