# US 2019/0356687 A1 · Attack detection method, attack detection device and bus system for a motor vehicle > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2019/0356687 A1 - Document ID: US20190356687A1 - Status: Published application - Kind: A1 - Application number: 16/524,016 - Filed: 2019-07-27 - Published: 2019-11-21 - Earliest claimed: 2015-03-30 - Assignees: Volkswagen Aktiengesellschaft - Applicants: Volkswagen Aktiengesellschaft - Inventors: Oliver HARTKOPP; Thorben MOOS - Web page: https://patentgrep.com/patent/US20190356687A1 ## CPC - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 12/40: Bus networks - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 67/12: specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks - H04L 2012/40273: {the transportation system being a vehicle} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract An attack detection method for a bus system of a motor vehicle, wherein communication rules for transmitting messages are determined for the bus system. The detection method includes receiving messages, which are sent via the bus system, and analyzing whether the received messages are received according to the communication rules. ## Claims ### Claim at position 1 -39. (canceled) ### Claim 40 An attack detection method for a bus system of a motor vehicle, wherein communication rules are defined for the transmission of messages, the attack detection method comprising: receiving messages sent via the bus system; and analyzing whether the received messages are received according to the communication rules, wherein the communication rules predefine a changeover of a message cycle depending on a predefined event and the analysis determines whether the received messages are received according to the predefined changeover of the message cycle. ### Claim 41 (depends on 40) The attack detection method of claim 40, wherein different communication rules are defined for different message types and the method further comprises analyzing messages of a specific message type. ### Claim 42 (depends on 40) The attack detection method of claim 40, wherein the communication rules further predefine a blocking time between two consecutive messages and the analysis determines whether two consecutive messages are received according to the predefined blocking time. ### Claim 43 (depends on 42) The attack detection method of claim 42, wherein the analysis determines whether the message content of two consecutive messages is identical. ### Claim 44 (depends on 40) The attack detection method of claim 40, wherein the communications rules predefine a change in a message cycle duration depending on a predefined event and the analysis determines whether the received messages are received according to the predefined change in the message cycle duration. ### Claim 45 (depends on 40) The attack detection method of claim 40, wherein the communication rules predefine a restart of a message cycle depending on a predefined event, and the analysis determines whether the received messages are received according to the restart of the message cycle. ### Claim 46 (depends on 45) The attack detection method of claim 45, wherein the analysis determines whether the received messages have the same message content before and after the restart of the message cycle. ### Claim 47 An attack detection device for a bus system for a motor vehicle, comprising: a microprocessor, wherein the attack detection device is configured to receive messages via the bus system and the microprocessor is configured to carry out an attack detection method for the bus system of the motor vehicle, wherein communication rules are defined for the transmission of messages, the attack detection method comprising receiving messages sent via the bus system, and analyzing whether the received messages are received according to the communication rules, wherein the communication rules predefine a changeover of a message cycle depending on a predefined event and the analysis determines whether the received messages are received according to the predefined changeover of the message cycle. ### Claim 48 (depends on 47) The device of claim 47, wherein different communication rules are defined for different message types and messages of a specific message type are analyzed. ### Claim 49 (depends on 47) The device of claim 47, wherein the communication rules further predefine a blocking time between two consecutive messages and the analysis determines whether two consecutive messages are received according to the predefined blocking time. ### Claim 50 (depends on 49) The device of claim 49, wherein the analysis determines whether the message content of two consecutive messages is identical. ### Claim 51 (depends on 47) The device of claim 47, wherein the communications rules predefine a change in a message cycle duration depending on a predefined event and the analysis determines whether the received messages are received according to the predefined change in the message cycle duration. ### Claim 52 (depends on 47) The device of claim 47, wherein the communication rules predefine a restart of a message cycle depending on a predefined event, and the analysis determines whether the received messages are received according to the restart of the message cycle. ### Claim 53 (depends on 52) The device of claim 52, wherein the analysis determines whether the received messages have the same message content before and after the restart of the message cycle. ### Claim 54 A bus system for a motor vehicle, comprising: at least one bus line and a plurality of bus participants configured to exchange messages with one another via the bus line, wherein at least one bus participant is configured to carry out an attack detection method for the bus system of the motor vehicle, wherein communication rules are defined for the transmission of messages, the attack detection method comprising receiving messages sent via the bus system, and analyzing whether the received messages are received according to the communication rules, wherein the communication rules predefine a changeover of a message cycle depending on a predefined event and the analysis determines whether the received messages are received according to the predefined changeover of the message cycle. ### Claim 55 (depends on 54) The bus system of claim 54, wherein different communication rules are defined for different message types and messages of a specific message type are analyzed. ### Claim 56 (depends on 54) The bus system of claim 54, wherein the communication rules predefine a blocking time between two consecutive messages and the analysis determines whether two consecutive messages are received according to the predefined blocking time. ### Claim 57 (depends on 56) The device of claim 56, wherein the analysis determines whether the message content of two consecutive messages is identical. ### Claim 58 (depends on 54) The bus system of claim 54, wherein the communications rules predefine a change in a message cycle duration depending on a predefined event and the analysis determines whether the received messages are received according to the predefined change in the message cycle duration. ### Claim 59 (depends on 54) The bus system of claim 54, wherein the communication rules predefine a restart of a message cycle depending on a predefined event, and the analysis determines whether the received messages are received according to the restart of the message cycle.