A system and method for providing security to a network may include maintaining, by a processor, a timing model of an expected behavior of data communications over the in-vehicle communication network; receiving, by the processor, a message sent over the network; determining, by the controller, based on the model and based on a timing attribute of the message, whether or not the message complies with the model; and if the message does not comply with the model then performing, by the processor, at least one action related to the message.

System and method for time based anomaly detection in an in-vehicle communication network

Embodiments of a device and method are disclosed. In an embodiment, a CAN device is disclosed. The CAN device includes a TXD input interface, a TXD output interface, an RXD input interface, an RXD output interface, and a traffic control system connected between the TXD input and output interfaces and between the RXD input and output interfaces. The traffic control system is configured to detect the presence of CAN Flexible Data-rate (FD) traffic on the RXD input interface and if the traffic control system detects the presence of CAN FD traffic on the RXD input interface, disconnect the RXD input interface from the RXD output interface and disconnect the TXD input interface from the TXD output interface.

Controller area network (CAN) device and method for controlling CAN traffic

An anomaly detector for a Controller Area Network (CAN) bus performs state space classification on a per-message basis of messages on the CAN bus to label messages as normal or anomalous, and performs temporal pattern analysis as a function of time to label unexpected temporal patterns as anomalous. The anomaly detector issues an alert if an alert criterion is met that is based on the outputs of the state space classification and the temporal pattern analysis. The temporal pattern analysis may compare statistics of messages having analyzed arbitration IDs with statistics for messages having those analyzed arbitration IDs in a training dataset of CAN bus messages, and a temporal pattern is anomalous if there is a statistically significant deviation from the training dataset. The anomaly detector may be implemented on a vehicle Electronic Control Unit (ECU) communicating via a vehicle CAN bus. The anomaly detector does not rely on an database of messages and their periodicity from manufacturers (dbc files) and in that sense is truly a zero knowledge detector.

Temporal anomaly detection on automotive networks

The invention provides a car networking CAN data collection method. The method comprises the steps that a DBC file and a configuration file for car body information collection are generated according to the collection item of the car body information; a car networking back-end server sends the configuration file to a vehicle-mounted terminal; the vehicle-mounted terminal collects the car body information data on a bus according to the configuration file; a data package is generated for a car body information data group; the data package is transmitted back to the car networking back-end server; and the car networking back-end server parses the data package to acquire the car body information. According to the invention, the method has the advantages of high adaptability, small dependence on the terminal, high data security and rapid and efficient acquisition of the car body information, is free of manual field operation, is simple and efficient, and is not error-prone; the configuration file is universal, can dynamically match different vehicle models in a car networking system, and can meet the collection requirements of multiple CAN bus interfaces in a vehicle model; and the car networking system has high compatibility.

Car networking CAN data acquisition method

A vehicle monitoring system, comprising: an interface configured to at least communicate with a controller area network bus; a remote data telecommunication interface; a database; at least one automated processor, configured to: extract information from the controller area network bus; store records in the database representing the extracted information; process the database to determine operating statistics; selectively communicate at least a portion of the database over the remote data telecommunication interface; and determine at least one of an operating parameter for the vehicle and a predicted net fuel cost based on at least the operating statistics and a fuel unit cost.

Interfacing with a vehicular controller area network

A security monitoring system for a Controller Area Network (CAN) comprises an Electronic Control Unit (ECU) operatively connected to the CAN bus. The ECU is programmed to classify a message read from the CAN bus as either normal or anomalous using an SVM-based classifier with a Radial Basis Function (RBF) kernel. The classifying includes computing a hyperplane curvature parameter γ of the RBF kernel as γ=ƒ(D) where ƒ( ) denotes a function and D denotes CAN bus message density as a function of time. In some such embodiments γ=ƒ(Var(D)) where Var(D) denotes the variance of the CAN bus message density as a function of time. The security monitoring system may be installed in a vehicle (e.g. automobile, truck, watercraft, aircraft) including a vehicle CAN bus, with the ECU operatively connected to the vehicle CAN bus to read messages communicated on the CAN bus. By not relying on any proprietary knowledge of arbitration IDs from manufacturers through their dbc files, this anomaly detector truly functions as a zero knowledge detector.

Anomaly detection for vehicular networks for intrusion and malfunction detection

A Support Vector Machine (SVM) classifier employs a kernel f(xi, y) ∞∏Dd≃1f(x i , d ,yd) or f(x i ,y) ΣD≃1f(x i , d ,yd) where D is the dimensionality of Support Vectors x ?i#191 and vector y is a vector being classified, e.g. representing a message communicated on a Controller Area Network (CAN) bus of a vehicle. The SVM classifier comprises a microprocessor or microcontroller programmed to perform classification using the SVM classifier with at least some terms F(x i,d ,y d ) of the kernel f(x I ,y ) determined using a look up table. For those terms F(x i ,y) of the kernel f(x i ,y) determined using a look up table, the dimension y d can only assume values defined by a finite set of values. In an embedded system, the microprocessor or microcontroller performs an embedded system function such as engine control, brake control, entertainment system operation, or so forth, or an embedded system function for a vehicle, ocean buoy, or satellite.

Kevin Mayhew

Papers

Anomaly detection for vehicular networks for intrusion and malfunction detection

Fast efficient evaluation of messages on automotive networks using look-up tables