SYSTEM AND METHOD FOR TIME BASED ANOMALY DETECTION IN AN IN-VEHICLE COMMUNICATION NETWORK

• US 20160381068A1
• Filed: 06/29/2016
• Published: 12/29/2016
• Est. Priority Date: 06/29/2015
• Status: Active Grant

• Current Assignee: Argus Cyber Security Ltd. (Continental AG)
• Original Assignee: Argus Cyber Security Ltd. (Continental AG)
• Inventors: GALULA, Yaron, BEN-NOON, Ofer, LAVI, Oron
• Granted Patent: US 10,298,612 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: B60R 16/0231 Circuits relating to the driving or the functioning of the vehicle monitoring tyres B60C23/00; indicating overspeed B60K31/00; for dash boards B60K37/00, B60Q3/10; for indicating emergencies B60Q1/52; brake control systems B60T; registering or indicating the working of vehicles G07C5/00; measuring distance G01C, e.g. combinations of speed and distance G01C23/00; engine indicators G01L; measuring speed or acceleration G01P
• CPC Class Codes: B60R 16/0232 for measuring vehicle parameters and indicating critical, abnormal or dangerous conditions
• CPC Class Codes: B60R 2021/01197 Warning devices
• CPC Class Codes: B60R 21/01 Electrical circuits for triggering passive safety arrangements, e.g. airbags, safety belt tighteners, in case of vehicle accidents or impending vehicle accidents electrical circuits for transmission of signals between steering wheel and the vehicle itself B60R16/027; for electrically actuating belt retractor locking means B60R22/343
• CPC Class Codes: B60R 25/10 actuating a signalling device
• CPC Class Codes: B60R 25/30 Detection related to theft or to other events relevant to anti-theft systems
• CPC Class Codes: G07C 5/0816 Indicating performance data, e.g. occurrence of a malfunction
• CPC Class Codes: G07C 5/0841 Registering performance data recording measured values G01D; information storage G11B
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
• CPC Class Codes: H04W 12/10 Integrity
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/61 Time-dependent
• CPC Class Codes: H04W 12/67 Risk-dependent, e.g. selecting a security level depending on risk profiles
• CPC Class Codes: H04W 12/68 Gesture-dependent or behaviour-dependent

Abstract

A system and method for providing security to a network may include maintaining, by a processor, a model of an expected behavior of data communications over the in-vehicle communication network; receiving, by the processor, a message sent over the network; determining, by the processor, based on the model and based on a timing attribute of the message, whether or not the message complies with the model; and if the message does not comply with the model then performing, by the processor, at least one action related to the message.

Claims

1. A system including a non-transitory computer readable medium including instructions that, when executed by at least one processor, cause the at least one processor to perform timing-based cyber-security operations, the operations including:

maintaining a timing model of an expected behavior of data communications over an in-vehicle communication network;

receiving a plurality of messages communicated over the network;

determining, based on the timing model and based on timing attributes of the plurality of messages, whether or not at least one of the messages complies with the timing model; and

if at least one message does not comply with the timing model then performing, by the processor, at least one action related to the message.

2. The system of claim 1, wherein determining whether or not at least one of the messages complies with the timing model includes determining that at least one of first and second messages is related to an anomaly by:

receiving first and a second messages sent over the in-vehicle communication network, the first and second messages including the same ID value; and

if the time lapse between receptions of the first and second messages is less than a time lapse threshold then determining that at least one of the first and second messages is related to an anomaly.

3. The system of claim 1, wherein determining whether or not at least one of the messages complies with the timing model includes determining that at least one of first and second messages is related to an anomaly by:

if the time lapse between receptions of first and second messages that include the same ID value is greater than a time lapse threshold then determining that at least one of the first and second messages is related to an anomaly.

4. The system of claim 1, wherein determining whether or not at least one of the messages complies with the timing model includes determining that at least one of first and second messages is related to an anomaly by:

if the time lapse between receptions of first and second messages is greater than a threshold then increasing a counter, and

if the counter is greater than a counter threshold then determining that at least one of the first and second messages is related to an anomaly.

5. The system of claim 4, wherein the processor is further configured to reset the counter to a predefined value if a predefined number of consecutive valid messages are identified.

6. The system of claim 1, wherein the processor is further configured to dynamically modify a time lapse threshold included in the timing model.

8. The system of claim 1, wherein the processor is further configured to:

identify an event related to at least one of;

the vehicle, the network, and a node connected to the network; and

determine a message is related to an anomaly based on the event.

9. The system of claim 1, wherein the at least one action related to the message includes isolating a portion of the network from the rest of the in-vehicle communication network in order to isolate a source of a message related to an anomaly.

10. The system of claim 1, wherein the processor is further configured to:

determine a component connected to an in-vehicle communication network is malfunctioning based on one or more messages; and

generate an indication related to the malfunctioning component.

11. The system of claim 1, wherein if at least one message does not comply with the timing model then performing, by the processor, at least one action related to the message comprises:

calculating a confidence level of a message being related to an anomaly; and

performing an action based on the confidence level.

12. The system of claim 1, wherein an action related to the message is at least one of:

disabling a component connected to the network, activating a component connected to the network, blocking a message, delaying a message, limiting a frequency of a message type, logging a message and alerting.

13. The system of claim 1, wherein determining whether or not at least one of the messages complies with the timing model includes:

comparing a time lapse between receptions of first and second messages to at least two time lapse thresholds; and

determining at least one of the messages does not comply with the timing model if at least one of the time lapse thresholds is breached.

7. The system of 1 claim, wherein the processor is further configured to:

determine a context related to at least one of;

the vehicle, the network, and a node connected to the network; and

determine whether or not a message is related to an anomaly based on the context.

14. A method comprising:

maintaining, by a processor, a timing model of an expected behavior of data communications over the in-vehicle communication network;

receiving, by the processor, a plurality of messages sent over the network;

determining, by the processor, based on the timing model and based on timing attributes of the plurality of messages, whether or not at least one of the messages complies with the timing model; and

if the message does not comply with the timing model then performing, by the processor, at least one action related to the message.

15. The method of claim 14, comprising:

receiving first and a second messages sent over the in-vehicle communication network, the first and second messages including the same ID value; and

if the time lapse between receptions of the first and second messages is less than a time lapse threshold then determining that at least one of the first and second messages is related to an anomaly.

16. The method of claim 14, comprising:

if the time lapse between receptions first and second messages including the same ID value is greater than a time lapse threshold then determining that at least one of the first and second messages is related to an anomaly.

17. The method of claim 14, comprising:

if a time lapse between receptions of first and second messages is less than a threshold then increasing a counter, and

if the counter is greater than a counter threshold then determining that at least one of the first and second messages is related to an anomaly.

18. The method of claim 17, comprising resetting the counter to a predefined value if a predefined number of consecutive valid messages are identified.

19. The method of claim 14, comprising dynamically modifying a time lapse threshold included in the timing model.

20. A method for enforcing security in a communication network, the method comprising:

maintaining, by a processor, a timing model related to messages communicated on the network;

receiving first message and a second message communicated on the network;

determining, based on the timing model and based on a time interval between the first and second messages, whether or not at least one of the first and second messages is related to an anomaly; and

if at least one of the first and second messages is related to an anomaly then performing at least one action related to the messages.