Data security inspection mechanism for serial networks

• US 10,666,671 B2
• Filed: 04/26/2017
• Issued: 05/26/2020
• Est. Priority Date: 04/26/2017
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Maluf, David A., Sudhaakar, Raghuram S., Doshi, Sanjiv
• Primary Examiner(s): Chiang, Jason
• Application Number:
  US15/497,806
• Publication Number:
  US 20180316700A1
• Time in Patent Office: 1,126 Days
• Field of Search: 726 23
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: G06N 5/046 Forward inferencing; Production systems
• CPC Class Codes: H04L 12/40 Bus networks
• CPC Class Codes: H04L 12/66 Arrangements for connecting between networks having differing types of switching systems, e.g. gateways
• CPC Class Codes: H04L 2012/40215 Controller Area Network CAN
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

In one embodiment, a device in a serial network determines that a suspicious event has occurred in the network. The suspicious event is identified based on timing information for one or more frames in the serial network. The device assesses whether the suspicious event is malicious by evaluating a sequence of events in the network that precede the suspicious event. The device causes a mitigation action to be performed in the network when the suspicious event is deemed malicious.

Claims

1. A method, comprising:

tracking, by a device in a serial network that is a controller area network (CAN) bus network, timing information associated with an inter-arrival time and a number of frames from each device in the serial network in a database;

determining, by the device in the serial network, that a suspicious event has occurred in the serial network, wherein the suspicious event is identified based on whether the inter-arrival time of one or more frames from a particular device in the serial network is within an expected range;

assessing, by the device, whether the suspicious event is malicious by evaluating a sequence of events in the serial network that precede the suspicious event, wherein the sequence of events a) specify an order of events that are expected to precede an event for the particular device and b) is determined based on a first-order analysis of data in the CAN bus network; and

causing, by the device, a mitigation action to be performed in the serial network when the suspicious event is deemed malicious.

2. The method as in claim 1, wherein the mitigation action comprises at least one of:

generating an alert regarding the suspicious event or blocking the one or more frames in the serial network associated with the suspicious event.

3. The method as in claim 1, wherein determining that the suspicious event has occurred comprises:

detecting, by the device, the one or more frames in the serial network; and

computing, by the device, the timing information for the one or more frames in the serial network.

4. The method as in claim 1, wherein determining that the suspicious event has occurred comprises:

receiving, at the device, an indication from a gateway in the serial network that the suspicious event is suspicious.

5. The method as in claim 4, wherein the device is a head unit in a vehicle.

6. The method as in claim 1, wherein assessing whether the suspicious event is malicious by evaluating a sequence of events in the serial network that precede the suspicious event comprises:

using, by the device, a behavioral model to evaluate the sequence of events.

7. The method as in claim 6, wherein the behavioral model is trained to detect frames in the serial network associated with user activity.

8. An apparatus, comprising:

one or more network interfaces to communicate with a serial network that is a controller area network (CAN) bus network;

a processor coupled to the one or more network interfaces and configured to execute a process; and

a memory configured to store the process executable by the processor, the process when executed configured to;

track timing information associated with an inter-arrival time and a number of frames from each device in the serial network in a database;

determine that a suspicious event has occurred in the serial network, wherein the suspicious event is identified based on whether the inter-arrival time of one or more frames from a particular device in the serial network is within an expected range;

assess whether the suspicious event is malicious by evaluating a sequence of events in the serial network that precede the suspicious event, wherein the sequence of events specify a) an order of events that are expected to precede an event for the particular device and b) is determined based on a first-order analysis of data in the CAN bus network; and

cause a mitigation action to be performed in the serial network when the suspicious event is deemed malicious.

9. The apparatus as in claim 8, wherein the mitigation action comprises at least one of:

generating an alert regarding the suspicious event or blocking one or more frames in the serial network associated with the suspicious event.

10. The apparatus as in claim 8, wherein the apparatus determines that the suspicious event has occurred by:

detecting the one or more frames in the serial network; and

computing the timing information for the one or more frames in the serial network.

11. The apparatus as in claim 8, wherein the apparatus determines that the suspicious event has occurred by:

receiving an indication from a gateway in the serial network that the suspicious event is suspicious.

12. The apparatus as in claim 11, wherein the apparatus is a head unit in a vehicle.

13. The apparatus as in claim 8, wherein the process when executed is further configured to:

use a behavioral model to evaluate the sequence of events.

14. The apparatus as in claim 13, wherein the behavioral model is trained to detect frames in the serial network associated with user activity.

15. A tangible, non-transitory, computer-readable medium storing program instructions that, when executed by a device in a serial network that is a controller area network (CAN) bus network, cause the device to perform a process comprising:

tracking, by the device, timing information associated with an inter-arrival time and a number of frames from each device in the serial network in a database;

determining, by the device, that a suspicious event has occurred in the serial network, wherein the suspicious event is identified based on whether the inter-arrival time of one or more frames from a particular device in the serial network is within an expected range;

assessing, by the device, whether the suspicious event is malicious by evaluating a sequence of events in the serial network that precede the suspicious event, wherein the sequence of events a) specify an order of events that are expected to precede an event for the particular device and b) is determined based on a first-order analysis of data in the CAN bus network; and

causing, by the device, a mitigation action to be performed in the serial network when the suspicious event is deemed malicious.

16. The computer-readable medium as in claim 15, wherein determining that the suspicious event has occurred comprises:

receiving, at the device, an indication from a gateway in the serial network that the suspicious event is suspicious.

17. The computer-readable medium as in claim 16, wherein the device is a head unit in a vehicle.