System and method for time based anomaly detection in an in-vehicle communication network

• US 10,298,612 B2
• Filed: 06/29/2016
• Issued: 05/21/2019
• Est. Priority Date: 06/29/2015
• Status: Active Grant

• Current Assignee: Argus Cyber Security Ltd. (Continental AG)
• Original Assignee: Argus Cyber Security Ltd. (Continental AG)
• Inventors: Galula, Yaron, Ben-Noon, Ofer, Lavi, Oron
• Primary Examiner(s): Mehedi, Morshed
• Application Number:
  US15/196,301
• Publication Number:
  US 20160381068A1
• Time in Patent Office: 1,056 Days
• CPC Class Codes: B60R 16/0231 Circuits relating to the driving or the functioning of the vehicle monitoring tyres B60C23/00; indicating overspeed B60K31/00; for dash boards B60K37/00, B60Q3/10; for indicating emergencies B60Q1/52; brake control systems B60T; registering or indicating the working of vehicles G07C5/00; measuring distance G01C, e.g. combinations of speed and distance G01C23/00; engine indicators G01L; measuring speed or acceleration G01P
• CPC Class Codes: B60R 16/0232 for measuring vehicle parameters and indicating critical, abnormal or dangerous conditions
• CPC Class Codes: B60R 2021/01197 Warning devices
• CPC Class Codes: B60R 21/01 Electrical circuits for triggering passive safety arrangements, e.g. airbags, safety belt tighteners, in case of vehicle accidents or impending vehicle accidents electrical circuits for transmission of signals between steering wheel and the vehicle itself B60R16/027; for electrically actuating belt retractor locking means B60R22/343
• CPC Class Codes: B60R 25/10 actuating a signalling device
• CPC Class Codes: B60R 25/30 Detection related to theft or to other events relevant to anti-theft systems
• CPC Class Codes: G07C 5/0816 Indicating performance data, e.g. occurrence of a malfunction
• CPC Class Codes: G07C 5/0841 Registering performance data recording measured values G01D; information storage G11B
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
• CPC Class Codes: H04W 12/10 Integrity
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/61 Time-dependent
• CPC Class Codes: H04W 12/67 Risk-dependent, e.g. selecting a security level depending on risk profiles
• CPC Class Codes: H04W 12/68 Gesture-dependent or behaviour-dependent

Abstract

A system and method for providing security to a network may include maintaining, by a processor, a model of an expected behavior of data communications over the in-vehicle communication network; receiving, by the processor, a message sent over the network; determining, by the processor, based on the model and based on a timing attribute of the message, whether or not the message complies with the model; and if the message does not comply with the model then performing, by the processor, at least one action related to the message.

Claims

1. A system including a non-transitory computer readable medium including instructions that, when executed by at least one hardware processor, cause the at least one hardware processor to perform timing-based cyber-security operations, the operations including:

maintaining a model of an expected timing behavior of data communications over an in-vehicle communication network, the model including a counter threshold value and a time laps threshold value;

receiving first and second messages communicated over the in-vehicle communication network, wherein the first and second messages include the same message ID value;

if the time lapse between receptions of the first and second messages is greater than the time laps threshold value then increasing a value in a counter;

if the value in the counter is greater than the counter threshold value then determining at least one of the messages is anomalous; and

if at least one of the first and second messages is anomalous then performing, by the processor, at least one action related to the anomalous message.

2. The system of claim 1, wherein

if the time lapse between receptions of the first and second messages is less than a time lapse threshold included in the model then determining that at least one of the first and second messages is related to an anomaly.

3. The system of claim 1, wherein

if the time lapse between receptions of the first and second messages is greater than the time lapse threshold then determining that at least one of the first and second messages is related to an anomaly.

4. The system of claim 1, wherein the processor is further configured to reset the counter to a predefined value if a predefined number of consecutive valid messages are identified.

5. The system of claim 1, wherein the processor is further configured to dynamically modify the time lapse threshold value.

7. The system of claim 1, wherein the processor is further configured to:

identify an event related to at least one of;

the vehicle, the network, and a node connected to the network; and

determine a message is related to an anomaly based on the event.

8. The system of claim 1, wherein the at least one action related to the message includes isolating a portion of the network from the rest of the in-vehicle communication network in order to isolate a source of a message related to an anomaly.

9. The system of claim 1, wherein the processor is further configured to:

determine a component connected to an in-vehicle communication network is malfunctioning based on one or more messages; and

generate an indication related to the malfunctioning component.

10. The system of claim 1, wherein if at least one message does not comply with the model then performing, by the processor, at least one action related to the message comprises:

calculating a confidence level of a message being related to an anomaly; and

performing an action based on the confidence level.

11. The system of claim 1, wherein an action related to the message is at least one of:

disabling a component connected to the network, activating a component connected to the network, blocking a message, delaying a message, limiting a frequency of a message type, logging a message and alerting.

12. The system of claim 1, wherein the hardware processor is further configured to:

determine whether or not at least one of the messages complies with the model by;

comparing a time lapse between receptions of first and second messages to at least two time lapse thresholds; and

determining at least one of the messages does not comply with the model if at least one of the time lapse thresholds is breached.

6. The system of 1 claim, wherein the processor is further configured to:

determine a context related to at least one of;

the vehicle, the network, and a node connected to the network; and

determine whether or not a message is related to an anomaly based on the context.

13. A method comprising:

maintaining, by a hardware processor, a model of an expected behavior of data communications over an in-vehicle communication network, the model including a counter threshold value and a time laps threshold value;

receiving, by the processor, first and second messages sent over the in-vehicle communication network, wherein the first and second messages include the same message ID value;

if the time lapse between receptions of the first and second messages is greater than the time laps threshold value then increasing a value in a counter;

if the value in the counter is greater than the counter threshold value then determining, by the processor, least one of the messages is anomalous; and

if at least one of the messages is anomalous then performing, by the processor, at least one action related to the message.

14. The method of claim 13, comprising:

if the time lapse between receptions of the first and second messages is less than a time lapse threshold included in the model then determining that at least one of the first and second messages is related to an anomaly.

15. The method of claim 13, comprising:

if the time lapse between receptions the first and second messages greater than the time lapse threshold then determining that at least one of the first and second messages is related to an anomaly.

16. The method of claim 13, comprising:

if a time lapse between receptions of the first and second messages is less than a threshold value included in the model then increasing a counter, and

if the counter is greater than a counter threshold value included in the model then determining that at least one of the first and second messages is related to an anomaly.

17. The method of claim 16, comprising resetting the counter to a predefined value if a predefined number of consecutive valid messages are identified.

18. The method of claim 13, comprising dynamically modifying the counter threshold value.

19. A method for enforcing security in a communication network, the method comprising:

maintaining, by a hardware processor, a model related to messages communicated on an in-vehicle data communication network, the model including a counter threshold value and a time laps threshold value;

receiving first message and second message communicated on the in-vehicle data communication network, wherein the first and second messages include the same message ID value;

if the time interval between receptions of the first and second messages is greater than the time laps threshold value then increasing a value in a counter;

if the value in the counter is greater than the counter threshold value then determining, whether or not at least one of the first and second messages is related to an anomaly; and

if at least one of the first and second messages is related to an anomaly then performing at least one action related to the messages.