System and method for consistency based anomaly detection in an in-vehicle communication network
A system and method for providing security to a network may include monitoring, by a processor, traffic on a first and second network portions of an in-vehicle communication network; determining whether or not a first message detected on the first network portion is anomalous based on at least one of: an attribute of a second message detected on the second network portion and an absence of a second message from the second network portion over a predefined time period; and, if it is determined the first message is anomalous then performing at least one action.
1. A system including a non-transitory computer readable medium including instructions that, when executed by at least one processor, cause the at least one processor to perform security operations, the operations comprising:
monitoring traffic on a first network portion of an in-vehicle communication network;
monitoring traffic on a second, different network portion of the in-vehicle communication network;
receiving a first message from the first network portion;
if a specific, second message was not received, from the second network portion, during a time interval that precedes a reception time of the first message or
if a specific, second message is not received, from the second network portion, during a time interval that follows the reception time of the first message, then determining that the first message is anomalous; and
if it is determined that the first message is anomalous, then performing at least one action.
2. The system of claim 1 , wherein performing the at least one action includes:
calculating a confidence level of the first message being related to an anomaly; and
performing an action based on the confidence level.
3. The system of claim 1 , wherein the at least one action includes at least one of: isolating a portion of the network from the rest of the in-vehicle communication network in order to isolate a source of a message related to an anomaly, disabling a component connected to the network, activating a component connected to the network, blocking a message, destroying a message, delaying a message, limiting a frequency of a message type, logging a message, and alerting.
4. A method comprising:
monitoring, by a processor, traffic on a first network portion of an in-vehicle communication network;
monitoring, by the processor, traffic on a second network portion of the in-vehicle communication network;
receiving a first message from the first network portion;
if a specific, second message was not received, from the second network portion, during a time interval that precedes a reception time of the first message or
if a specific, second message is not received, from the second network portion, during a time interval that follows the reception time of the first message then determining, by the processor, that the first message is anomalous; and
if it is determined that the first message is anomalous, then performing, by the processor, at least one action.
5. The method of claim 4 , wherein performing the at least one action includes:
calculating a confidence level of the first message being related to an anomaly; and
performing the at least one action based on the confidence level.
6. A method comprising:
monitoring, by a processor, traffic on a first network portion of an in-vehicle communication network;
monitoring by the processor, traffic on a second, different network portion of the in-vehicle communication network;
examining, by the processor, a first message received from the first network;
if a specific, second message is absent from the second network portion, during a time interval that precedes a reception time of the first message, or
if the specific, second message is absent from the second network portion during a time interval that follows the reception time of the first message, then determining, by the processor, that the first message is related to an anomaly; and
if it is determined that the first message is related to an anomaly then performing, by the processor, at least one action.
7. The method of claim 6 , wherein the at least one action includes:
calculating a confidence level of the first message being related to an anomaly; and
performing an action based on the confidence level.
8. The method of claim 6 , wherein the at least one action includes at least one of: isolating a portion of the network from the rest of the in-vehicle communication network in order to isolate a source of a message related to an anomaly, disabling a component connected to the network, activating a component connected to the network, blocking a message, destroying a message, delaying a message, limiting a frequency of a message type, logging a message, and alerting.