Detection and localization of attack on a vehicle communication network

A system for determining an attack on a vehicle network and an estimated source location of an attacker, the system comprising:

• one or more vehicles, wherein each vehicle comprises:
• a memory;
• and
• one or more processors coupled to the memory, wherein the one or more processors are operable to:
• receive a plurality of messages;
• analyze each of the plurality of messages to determine whether each of the plurality of messages is suspicious;
• determine that an attack is occurring in response to a determination that multiple messages of the plurality of messages are suspicious;
• localize a source location for the attack using an angle of arrival (AoA) associated with each of the plurality of suspicious messages to determine a source intersection;
• and
• notify one or more vehicles of the attack.

A non-transitory computer readable storage medium having program instructions embodied therewith, the program instructions readable by a processor to cause the processor to perform a method for determining an attack on a vehicle network and an estimated source location of an attacker comprising:

• receiving a plurality of messages;
• analyzing each of the plurality of messages to determine whether each of the plurality of messages is suspicious;
• determining that an attack is occurring in response to a determination that multiple messages of the plurality of messages are suspicious;
• localizing a source location for the attack using an angle of arrival associated with each of the plurality of suspicious messages to determine a source intersection;
• and
• notifying one or more vehicles of the attack.