In-vehicle network anomaly detection
A method of identifying a node of a plurality of nodes in an in-vehicle communications network that transmitted a waveform propagating in the network, comprising comparing a fingerprint generated for the propagating voltage waveform with a library having library fingerprints that are unique for waveforms transmitted by each node to determine which node transmitted the waveform.
1. A method of determining a fingerprint characterizing a node that generates frame waveforms in an in-vehicle communications network, the method comprising: receiving a plurality of analog voltage waveforms representing bit streams transmitted over the in-vehicle network by a plurality of J nodes comprised in the in-vehicle network;
sampling and analyzing each of the analog voltage waveforms to generate a discrete time sequence of features for the waveform;
processing the discrete time sequence of features to generate a discrete time sequence of derivatives of the analog waveform;
processing the discrete time sequence of derivatives in accordance with an integral transform to generate a discrete transform sequence comprising a sequence of functions multiplied by respective amplitudes;
providing a fingerprint of the node—that comprises a feature vector having components based on the amplitudes.
2. The method according to claim 1 , wherein the time sequence of features comprises one or a combination of two or more of: dominant voltage signals V( 0 ); voltage signals during a rising voltage transition from V( 1 ) to V( 0 ); or voltage signals during a falling voltage transition from (V( 0 ) to V( 1 ).
3. The method according to claim 1 , wherein the time sequence of features comprise one or more of: rise times of rising voltage transitions from V( 1 ) to V( 0 ) or fall times of falling voltage transitions from (V( 0 ) to V( 1 ).
4. The method according to claim 1 , and comprising detrending the time sequence of features of the waveform relative to a time-dependent trend that the time sequence of features exhibits.
5. The method according to claim 1 , wherein the time dependent trend is a linear trend.
6. The method according to claim 1 wherein the integral transformation comprises a transform chosen from a group of transforms consisting of: a Fourier transform, Laplace transform, and wavelet transform.
7. The method according to claim 1 wherein the in-vehicle communications network is a controller area network (CAN).