Temporal anomaly detection on automotive networks
An anomaly detector for a Controller Area Network (CAN) bus performs state space classification on a per-message basis of messages on the CAN bus to label messages as normal or anomalous, and performs temporal pattern analysis as a function of time to label unexpected temporal patterns as anomalous. The anomaly detector issues an alert if an alert criterion is met that is based on the outputs of the state space classification and the temporal pattern analysis. The temporal pattern analysis may compare statistics of messages having analyzed arbitration IDs with statistics for messages having those analyzed arbitration IDs in a training dataset of CAN bus messages, and a temporal pattern is anomalous if there is a statistically significant deviation from the training dataset. The anomaly detector may be implemented on a vehicle Electronic Control Unit (ECU) communicating via a vehicle CAN bus. The anomaly detector does not rely on an database of messages and their periodicity from manufacturers (dbc files) and in that sense is truly a zero knowledge detector.
1. An anomaly detector for a Controller Area Network (CAN) bus, the anomaly detector comprising an electronic data processing device programmed to perform an anomaly alerting method including the operations of:
performing state space classification on a per-message basis of messages on the CAN bus to label each message as either normal or anomalous wherein the state space classification employs a classifier;
performing temporal pattern analysis of messages on the CAN bus as a function of time to label unexpected temporal patterns as anomalous wherein the temporal pattern analysis includes the operations of comparing statistics of messages having analyzed arbitration IDs with statistics for messages having the analyzed arbitration IDs in a training dataset of CAN bus messages and labeling a temporal pattern of messages on the CAN bus as anomalous if the statistics comparison indicates a statistically significant deviation from the training dataset of CAN bus messages wherein the analyzed arbitration IDs include arbitration IDs that appear in the training dataset of CAN bus messages and satisfy a periodicity criterion in the training dataset of CAN bus messages wherein an arbitration ID satisfies the periodicity criterion if
t
ima
,
max
t
ima
,
min
≤
T
p
where T p is a threshold and t ima,max and t ima,min are a maximum inter-message arrival time and a minimum inter-message arrival time, respectively, over a time window; and
issuing an alert if an alert criterion is met that is based on the outputs of the state space classification and the temporal pattern analysis.
2. A vehicle including:
a vehicle Controller Area Network (CAN) bus; and
a vehicle Electronic Control Unit (ECU) communicating via the vehicle CAN bus, the vehicle ECU programmed to implement an anomaly detector as set forth in claim 1 .
3. The anomaly detector of claim 1 wherein the anomaly alerting method includes the further operation of:
comparing header information for each message on the CAN bus with a list of observed headers;
wherein the alert criterion is further based on the output of the header information comparison.
4. The anomaly detector of claim 1 wherein the statistics include statistics pertaining to inter-message arrival times.
5. The anomaly detector of claim 1 wherein the comparing includes adjusting the statistics for collision avoidance backoff-retransmit operations performed by the CAN bus.
6. The anomaly detector of claim 1 wherein the analyzed arbitration IDs are classified by the temporal pattern analysis with accuracy satisfying a threshold for data partitioned from the training dataset of CAN bus messages.
7. The anomaly detector of claim 1 wherein 1.0≤T p ≤2.0.
8. The anomaly detector of claim 1 wherein the state space classification employs a Support Vector Machine (SVM)-based classifier.
9. The anomaly detector of claim 1 implemented in one of a vehicle, nuclear reactor control system, orbiting satellite, ocean buoy, or medical system.
10. An anomaly detector for a Controller Area Network (CAN) bus, the anomaly detector comprising an electronic data processing device programmed to perform an anomaly alerting method including the operations of:
performing temporal pattern analysis of messages on the CAN bus as a function of time to label unexpected temporal patterns as anomalous wherein the temporal pattern analysis includes comparing statistics of messages having analyzed arbitration IDs with statistics for messages having the analyzed arbitration IDs in a training dataset of CAN bus messages wherein the analyzed arbitration IDs include arbitration IDs that appear in the training dataset of CAN bus messages and satisfy a periodicity criterion in the training dataset of CAN bus messages wherein an arbitration ID satisfies the periodicity criterion if
t
ima
,
max
t
ima
,
min
≤
T
p
where T p is a threshold and t ima,max and t ima,min are a maximum inter-message arrival time and a minimum inter-message arrival time, respectively, over a time window; and
issuing an alert for a temporal pattern of messages on the CAN bus if the statistics comparison for the temporal pattern indicates a statistically significant deviation from the training dataset of CAN bus messages.
11. The anomaly detector of claim 10 wherein the statistics include statistics pertaining to inter-message arrival times.
12. The anomaly detector of claim 10 wherein the comparing includes adjusting the statistics for collision avoidance backoff-retransmit operations performed by the CAN bus.
13. The anomaly detector of claim 10 wherein the analyzed arbitration IDs are classified by the temporal pattern analysis with accuracy satisfying a threshold for data partitioned from the training dataset of CAN bus messages.
14. The anomaly detector of claim 10 wherein 1.0≤T p ≤2.0.
15. The anomaly detector of claim 10 implemented in one of a vehicle, nuclear reactor control system, orbiting satellite, ocean buoy, or medical system.
16. A vehicle including:
a vehicle Controller Area Network (CAN) bus; and
a vehicle Electronic Control Unit (ECU) communicating via the vehicle CAN bus, the vehicle ECU programmed to implement an anomaly detector as set forth in claim 10 .
17. An anomaly alerting method monitoring communication on a Controller Area Network (CAN) bus, the anomaly alerting method including the operations of:
performing temporal pattern analysis of statistics of inter-message arrival times of messages on the CAN bus as a function of time to label unexpected temporal patterns as anomalous wherein the temporal pattern analysis includes comparing statistics of messages having analyzed arbitration IDs with statistics for messages having the analyzed arbitration IDs in a training dataset of CAN bus messages wherein the analyzed arbitration IDs include arbitration IDs that satisfy a periodicity criterion in the training dataset of CAN bus messages wherein an arbitration ID satisfies the periodicity criterion if a ratio of t ima,max and t ima,min satisfies a threshold where t ima,max and t ima,min are a maximum inter-message arrival time and a minimum inter-message arrival time, respectively, over a time window; and
issuing an alert if an alert criterion is met that is based at least on the output of the temporal pattern analysis;
wherein the anomaly alerting method is performed by an electronic data processing device.
18. The anomaly alerting method of claim 17 including the further operation of:
performing state space classification on a per-message basis of messages on the CAN bus to label each message as either normal or anomalous;
wherein the alert criterion is based on the outputs of the state space classification and the temporal pattern analysis.
19. A non-transitory storage medium readable and executable by an electronic data processing device to perform an anomaly alerting method to monitor communication on a Controller Area Network (CAN) bus, the anomaly alerting method including the operations of:
performing temporal pattern statistical analysis of messages on the CAN bus as a function of time to label unexpected temporal patterns as anomalous wherein the temporal pattern analysis includes comparing statistics of messages having analyzed arbitration IDs with statistics for messages having the analyzed arbitration IDs in a training dataset of CAN bus messages wherein the analyzed arbitration IDs include arbitration IDs that satisfy a periodicity criterion in the training dataset of CAN bus messages wherein an arbitration ID satisfies the periodicity criterion if a ratio of maximum and minimum inter-message arrival times, respectively, over a time window satisfies a threshold; and
issuing an alert if an alert criterion is met that is based at least on the output of the temporal pattern statistical analysis;
wherein the temporal pattern statistical analysis includes adjusting the statistics for collision avoidance backoff-retransmit operations performed on the CAN bus.
20. The non-transitory storage medium of claim 19 wherein the anomaly alerting method includes the further operation of:
performing state space classification on a per-message basis of messages on the CAN bus to label each message as either normal or anomalous;
wherein the alert criterion is based on the outputs of the state space classification and the temporal pattern statistical analysis.