System and method for time based anomaly detection in an in-vehicle communication network

1. A system including a non-transitory computer readable medium including instructions that, when executed by at least one processor, cause the at least one processor to perform timing-based cyber-security operations, the operations including:

maintaining a timing model of an expected behavior of data communications over an in-vehicle communication network;

receiving a plurality of messages communicated over the network;

determining, based on:

monitoring time lapses related to the plurality of messages having a message ID value,

calculating an average time lapse for a message ID value, and

relating the average time lapse to a threshold included in the timing model

whether or not at least one of the messages is related to an anomaly; and

if at least one message is related to an anomaly then performing, by the processor, at least one action related to the message;

wherein the action is at least one of: disabling a component connected to the network, activating a component connected to the network, blocking a message, delaying a message, limiting a frequency of a message type, logging a message, and alerting.

2. The system of claim 1 , wherein the threshold is dynamically modified.

3. The system of claim 1 , wherein the processor is configured to:

determine a context related to at least one of: the vehicle, the network, and a node connected to the network; and

determine a message is related to an anomaly based on the context.

4. The system of claim 1 , wherein the processor is configured to:

identify an event related to at least one of: the vehicle, the network, and a node connected to the network; and

determine a message is related to an anomaly based on the event.

5. The system of claim 1 , wherein the at least one action related to the message includes isolating a portion of the network from the rest of the in-vehicle communication network in order to isolate a source of a message related to an anomaly.

6. The system of claim 1 , wherein the processor is configured to:

determine a whether or not a component connected to in-vehicle communication network is malfunctioning based on one or more messages; and

generate an indication related to the malfunctioning component.

7. The system of claim 1 , wherein performing, by the processor, at least one action related to the message includes:

calculating a confidence level of a message being related to an anomaly; and

performing an action based on the confidence level.

8. The system of claim 1 , wherein maintaining the timing model and performing the at least one action is performed in real-time.

9. The system of claim 1 , wherein if the message does not comply with the timing model then excluding the message from subsequent calculation of an average time lapse.

10. A method comprising:

maintaining, by a processor, a timing model of an expected behavior of data communications over the in-vehicle communication network;

receiving, by the processor, a plurality of messages sent over the network;

determining, by the controller, based on:

monitoring time lapses related to the plurality of messages having a message ID value;

calculating an average time lapse for a message ID value; and

based on relating the average time lapse to a threshold included in the timing model,

whether or not at least one of the messages related to an anomaly; and

if the message does not comply with the timing model then performing, by the processor, at least one action related to the message;

wherein the action is at least one of: disabling a component connected to the network, activating a component connected to the network, blocking a message, delaying a message, limiting a frequency of a message type, logging a message, and alerting.

11. The method of claim 10 , wherein the threshold is dynamically modified.

12. The method of 10 , comprising:

determining a context related to at least one of: the vehicle, the network, and a node connected to the network; and

determining whether or not a message complies with the timing model based on the context.

13. The method of 10 , comprising:

identifying an event related to at least one of: the vehicle, the network, and a node connected to the network; and

determining whether or not a message complies with the timing model based on the event.

14. The method of 10 , wherein the at least one action related to the message includes isolating a portion of the network from the rest of the in-vehicle communication network in order to isolate a source of a message related to an anomaly.

15. The method of 10 , comprising:

determining whether or not a component connected to in-vehicle communication network is malfunctioning based on one or more messages; and

generating an indication related to the malfunctioning component.

16. The method of 10 , comprising:

calculating a confidence level of a message being related to an anomaly; and

wherein performing the action is based on the confidence level.

17. A method for enforcing security in a communication network, the method comprising:

maintaining, by a processor, a timing model related to messages communicated on the network;

receiving a first message and a second message communicated on the network;

determining, based on:

monitoring time lapses related to the plurality of messages having a message ID value,

calculating an average time lapse for a message ID value, and

relating the average time lapse to a threshold included in the timing model,

whether or not at least one of the first and second messages is related to an anomaly; and

if at least one of the first and second messages is related to an anomaly then performing at least one action related to the messages;

wherein the action is at least one of: disabling a component connected to the network, activating a component connected to the network, blocking a message, delaying a message, limiting a frequency of a message type, logging a message, and alerting.