Anomaly detection for vehicular networks for intrusion and malfunction detection
First Claim
1. A Support Vector Machine (SVM) classifier training device comprising:
- a computer including at least one microprocessor programmed to train a Support Vector Machine (SVM) one-class classifier using a Radial Basis Function (RBF) kernel K calculated using the equation;
K(xi−
xj)=e−
γ
∥
xi−
xj)∥
2 where xε
and γ
>
0where is a set of all real numbers, xi and xj are features of a training set, and γ
represents a curvature of a hyperplane and varies with message density D in time according to;
1 Assignment
0 Petitions
Accused Products
Abstract
A security monitoring system for a Controller Area Network (CAN) comprises an Electronic Control Unit (ECU) operatively connected to the CAN bus. The ECU is programmed to classify a message read from the CAN bus as either normal or anomalous using an SVM-based classifier with a Radial Basis Function (RBF) kernel. The classifying includes computing a hyperplane curvature parameter γ of the RBF kernel as γ=ƒ(D) where ƒ( ) denotes a function and D denotes CAN bus message density as a function of time. In some such embodiments γ=ƒ(Var(D)) where Var(D) denotes the variance of the CAN bus message density as a function of time. The security monitoring system may be installed in a vehicle (e.g. automobile, truck, watercraft, aircraft) including a vehicle CAN bus, with the ECU operatively connected to the vehicle CAN bus to read messages communicated on the CAN bus. By not relying on any proprietary knowledge of arbitration IDs from manufacturers through their dbc files, this anomaly detector truly functions as a zero knowledge detector.
24 Citations
12 Claims
-
1. A Support Vector Machine (SVM) classifier training device comprising:
-
a computer including at least one microprocessor programmed to train a Support Vector Machine (SVM) one-class classifier using a Radial Basis Function (RBF) kernel K calculated using the equation;
K(xi−
xj)=e−
γ
∥
xi −
xj )∥2 where xε
and γ
>
0where is a set of all real numbers, xi and xj are features of a training set, and γ
represents a curvature of a hyperplane and varies with message density D in time according to; - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9)
-
-
10. A system comprising:
- a Support Vector Machine (SVM) classifier training device comprising a computer including at least one microprocessor programmed to train a Support Vector Machine (SVM) one-class classifier using a Radial Basis Function (RBF) kernel K calculated using the equation;
K(xi−
xj)=e−
γ
∥
xi −
xj )∥2 where xε
and γ
>
0where is a set of all real numbers, xi and xj are features of a training set, and γ
represents a curvature of a hyperplane and varies with message density D in time according to; - View Dependent Claims (11, 12)
- a Support Vector Machine (SVM) classifier training device comprising a computer including at least one microprocessor programmed to train a Support Vector Machine (SVM) one-class classifier using a Radial Basis Function (RBF) kernel K calculated using the equation;
Specification