Method and device for detecting an attack on a serial communications system

A non-transitory computer readable medium including a computer program with program code for carrying out a method for detecting an attack on a serial communications system when the program code is executed on a computer, a processor or a programmable hardware component, the method comprising:

• determining a respective state of a plurality of messages transmitted via the serial communications system to obtain a sequence of states, wherein the state of each of the plurality of messages is based in each case on a plurality of properties of the message and a plurality of properties of a preceding message of the plurality of messages;
• comparing the sequence of states with at least one reference sequence;
• and
• determining that an attack is being carried out on the serial communications system in response to the sequence of states deviates deviating from the reference sequence.

A device for detecting an attack on a serial communications system, the device comprising a processor circuit configured to:

• determine a respective state of a plurality of messages transmitted via the serial communications system to obtain a sequence of states, wherein the state of one of the plurality of messages is based in each case on a plurality of properties of the message and a plurality of properties of a preceding message of the plurality of messages;
• compare the sequence of states with at least one reference sequence;
• and
• determine that an attack is being carried out on the serial communications system in response to the sequence of states deviating from the reference sequence.