System and method for content based anomaly detection in an in-vehicle communication network

1. A system including a non-transitory computer readable medium including instructions that, when executed by at least one computer hardware processor, cause the at least one computer hardware processor to perform content-based cyber-security operations, the operations including:

maintaining a content model of an expected behavior of data communications over an in-vehicle communication network included in a vehicle;

receiving first and second messages communicated over the in-vehicle communication network, wherein the first and second messages include the same identification (ID) value;

if a difference between first and second values respectively included in the first and second messages is greater than a threshold included in the content model, then determining at least one of the messages is related to malicious activity, wherein the values are provided by one or more components connected to the in-vehicle network; and

if determining at least one message is related to malicious activity, then performing, by the processor, at least one action including selectively logging a message communicated over the in-vehicle network.

2. The system of claim 1 , wherein the processor is further configured to determine whether or not at least one of the messages complies with the content model by:

determining a rate of change of a value of a signal based on examining content in a plurality of messages; and

determining at least some of the plurality messages are related to malicious activity based on comparing the rate of change to a threshold.

3. The system of claim 1 , wherein the processor is configured to:

determine a context related to at least one of: the vehicle, the network, and a node connected to the network; and

determine a message is related to malicious activity based on the context.

4. The system of claim 1 , wherein the processor is configured to:

identify an event related to at least one of: the vehicle, the network, and a node connected to the network; and

determine a message is related to malicious activity based on the event.

5. The system of claim 1 , wherein an action related to the message is at least one of: disabling a component connected to the network, activating a component connected to the network, blocking a message, selectively preventing a message from being communicated over the in-vehicle network, delaying a message, limiting a frequency of a message type, logging a message, alerting, and isolating a portion of the network from the rest of the in-vehicle communication network in order to isolate a source of a message related to malicious activity.

6. The system of claim 1 , wherein the processor is configured to:

determine whether or not a component connected to in-vehicle communication network is malfunctioning based on one or more messages; and

generate an indication related to the malfunctioning component.

7. The system of claim 1 , wherein performing, by the processor, at least one action related to the message includes:

calculating a confidence level of a message being related to malicious activity; and

performing an action based on the confidence level.

8. The system of claim 1 , wherein the processor is configured to identify malicious activity based on a message and based on one or more previous messages.

9. The system of claim 1 , wherein the processor is configured to dynamically update the content model.

10. A method comprising:

maintaining, by a processor, a content model of an expected behavior of data communications over an in-vehicle communication network included in a vehicle;

receiving, by the processor, first and second messages communicated over the in-vehicle communication network, wherein the first and second messages include the same identification (ID) value;

if a difference between first and second values respectively included in the first and second messages is greater than a threshold included in the content model then determining, by the processor, at least one of the messages is related to malicious activity, wherein the values are provided by one or more components connected to the in-vehicle network; and

if determining at least one message is related to malicious activity then performing, by the processor, at least one action including selectively logging a message communicated over the in-vehicle network.

11. The method of claim 10 , comprising:

determining a rate of change of a value of a signal based on examining content in a plurality of messages; and

determining at least some of the plurality messages are related to malicious activity based on comparing the rate of change to a threshold.

12. The method of claim 10 , comprising:

determining a context related to at least one of: the vehicle, the network, and a node connected to the network; and

determining a message is related to malicious activity based on the context.

13. The method of claim 10 , comprising:

identifying an event related to at least one of: the vehicle, the network, and a node connected to the network; and

determining a message is related to malicious activity based on the event.

14. The method of claim 10 , wherein an action related to the message is at least one of: disabling a component connected to the network, activating a component connected to the network, blocking a message, selectively preventing a message from being communicated over the in-vehicle network, delaying a message, limiting a frequency of a message type, logging a message, alerting, and isolating a portion of the network from the rest of the in-vehicle communication network in order to isolate a source of a message related to malicious activity.

15. The method of claim 10 , comprising:

determining a component connected to in-vehicle communication network is malfunctioning based on one or more messages; and

generating an indication related to the malfunctioning component.

16. The method of claim 10 , wherein performing, by the processor, at least one action related to the message includes:

calculating a confidence level of a message being related to malicious activity; and

performing an action based on the confidence level.

17. The method of claim 10 , comprising dynamically updating the content model.