System and method for anomaly detection in diagnostic sessions in an in-vehicle communication network

1. A method of monitoring communications propagating in an in-vehicle communications network of a vehicle, the method comprising:

monitoring messages transmitted over at least a portion of the in-vehicle network;

determining if the transmitted messages are indicative of at least one current data transfer session being conducted over the in-vehicle network;

comparing at least one feature of a given message of the transmitted messages to at least one expected feature of a message comprised in a model of the at least one current data transfer session to determine whether or not the at least one feature of the transmitted message is expected;

determining that the given transmitted message is an anomalous message if the feature of the given transmitted message is determined to be unexpected;

wherein comparing the at least one feature comprises determining whether or not the given transmitted message is configured to initiate a data transfer session different from the determined at least one current data transfer session; and

wherein if the given transmitted message is determined to be configured to initiate a different data transfer session, comprising determining that the given transmitted message is anomalous based on the different data transfer session and a context of the vehicle and/or in-vehicle communications network.

2. The method according to claim 1 wherein the at least one feature of the given transmitted message comprises a source port at which the given transmitted message is received by the in-vehicle communication network.

3. The method according to claim 1 wherein the at least one feature of the transmitted message comprises a destination of the given transmitted message in the in-vehicle communications network, and/or an identity (ID) of the given transmitted message.

4. The method according to claim 1 wherein the at least one feature of the given transmitted message comprises a value in a payload of the given transmitted message.

5. The method according to claim 1 wherein the at least one expected feature designates a context of the vehicle and/or the in-vehicle communications network.

6. The method according to claim 5 wherein comparing the at least one feature of the given transmitted message to determine whether or not the at least one feature of the given transmitted message is expected comprises determining whether the given transmitted message is expected for the designated context.

7. A method of monitoring communications propagating in an in-vehicle communications network of a vehicle, the method comprising:

monitoring messages transmitted over at least a portion of the in-vehicle network;

determining if the transmitted messages are indicative of at least one current standard data transfer session being conducted over the in-vehicle network;

comparing at least one feature of a given message of the transmitted messages to at least one expected feature of a message comprised in a model of the at least one current data transfer session to determine whether or not the at least one feature of the transmitted message is expected;

determining that the given transmitted message is an anomalous message if the feature of the given transmitted message is determined to be unexpected;

wherein if the given transmitted message is determined not to be configured to initiate a different data transfer session, comparing the at least one feature comprises determining whether the given transmitted message is a message belonging to a data session of the at least one current data transfer session and if not determining that the given transmitted message is unexpected.

8. The method according to claim 1 wherein the at least one feature of the given transmitted messages comprises a time interval between transmission of the given transmitted message and another message of the monitored messages.

9. The method according to claim 1 wherein the at least one feature of the given transmitted message comprises an order of transmission of the given transmitted message and another message of the monitored messages.

10. The method according to claim 1 wherein monitoring messages transmitted over at least a portion of the in-vehicle network comprises monitoring messages transmitted over a plurality of different portions of the in-vehicle network.

11. The method according to claim 10 and comprising determining that a first message transmitted over a first portion of the plurality of portions is anomalous if it is inconsistent with a second message transmitted over a second portion of the plurality of portions.

12. The method according to claim 11 and comprising determining that the first message is inconsistent with the second message if the first and second messages are received from different source ports.

13. The method according to claim 1 wherein if the monitored messages are not indicative of at least one current data transfer session being conducted over the in-vehicle network the given transmitted message is determined to be anomalous.

14. The method according to claim 1 and comprising generating the model of the data transfer session.

15. The method according to claim 1 and comprising updating the model to reduce false positive and/or false negatives in determining whether a message is anomalous or not.

16. The method according to claim 1 wherein data transfer session comprises a diagnostic session.

17. The method according to claim 1 wherein data transfer session comprises software update session.

18. A method of monitoring communications propagating in an in-vehicle communications network of a vehicle, the method comprising:

monitoring messages transmitted over at least a portion of the in-vehicle network;

determining if the transmitted messages are indicative of at least one current data transfer session being conducted over the in-vehicle network;

comparing at least one feature of a given message of the transmitted messages to at least one expected feature of a message comprised in a model of the at least one current data transfer session to determine whether or not the at least one feature of the transmitted message is expected wherein the at least one feature comprises a time interval between transmission of the given transmitted message and another message of the monitored messages;

determining that the given transmitted message is an anomalous message if the feature of the given transmitted message is determined to be unexpected.

19. A method of monitoring communications propagating in an in-vehicle communications network of a vehicle, the method comprising:

monitoring messages transmitted over at least a portion of the in-vehicle network;

determining if the transmitted messages are indicative of at least one current data transfer session being conducted over the in-vehicle network;

comparing at least one feature of a given message of the transmitted messages to at least one expected feature of a message comprised in a model of the at least one current data transfer session to determine whether or not the at least one feature of the transmitted message is expected wherein the at least one feature of the given transmitted message comprises an order of transmission of the given transmitted message and another message of the monitored messages;

determining that the given transmitted message is an anomalous message if the feature of the given transmitted message is determined to be unexpected.

20. A method of monitoring communications propagating in an in-vehicle communications network of a vehicle, the method comprising:

monitoring messages transmitted over at least a portion of the in-vehicle network;

determining if the transmitted messages are indicative of at least one data transfer session being conducted over the in-vehicle network;

comparing at least one feature of a given message of the transmitted messages to at least one expected feature of a message comprised in a model of the at least one current data transfer session to determine whether or not the at least one feature of the transmitted message is expected and if the transmitted message is configured to initiate a data transfer session different from the determined at least one current data transfer session determining that the transmitted message is unexpected;

determining that the given transmitted message is an anomalous message if the feature of the given transmitted message is determined to be unexpected.