Method for protection from cyber attacks to a vehicle based upon time analysis, and corresponding device

1. A method for protection from cyber attacks in a communication network, in particular a CAN (Controller Area Network), of a vehicle, wherein the vehicle includes a communication bus, in particular a CAN-bus, and a plurality of nodes associated to said communication bus in a signal-exchange relationship and associated at least in part to control units for controlling functions of the vehicle,

wherein the nodes exchange messages passing between nodes of the plurality of nodes, and

the messages are identified by respective message identifiers,

said method including, at a control node associated to said communication bus, the steps of:

selecting, from among the messages exchanged between the nodes, periodic messages having a transmission periodicity,

grouping said periodic messages into respective groups according to the respective period, and

performing a procedure of analysis of messages of the nodes that exchange said received periodic messages, which comprises, for each group of transmission periodicity:

obtaining times of arrival at the respective nodes of a set of periodic messages that have the same message identifier,

computing as a function of said arrival times average-offset values over successive subsets, of a given number of messages, of said set of received messages,

accumulating said average-offset values for each identifier with respect to each successive subset to obtain accumulated-offset values for each successive subset and a respective identifier,

identifying linear parameters by computing a regression over said accumulated-offset values for each successive subset and respective identifier, said computation comprising computing an angular coefficient, or slope, of the regression, and an intercept, or identification error,

computing, on the basis of average-offset values obtained at the step of computing as a function of said arrival times average-offset values over successive subsets, a correlation coefficient (p) of the average offset of pairs of messages identified as coming from one and the same node,

performing a first check to determine whether the correlation coefficient is higher than a first given threshold,

performing a second check to determine whether the angular coefficient between two consecutive messages with the same identifier is higher than a second given threshold,

performing a third check to determine whether the intercept between two consecutive messages is higher than a third given threshold, and

supplying the results of said first check, said second check, and said third check to a message-classification operation, configured to supply a confirmation of classification of the messages according to the transmitting node and message identifier or an indication of classification error as a function of said results.

2. The method as set forth in claim 1 , wherein, if the correlation coefficient is higher than a first given threshold, the classification operation further includes the step of indicating the node that is transmitting the messages as corresponding to the nominal node; if the correlation coefficient is lower, the classification operation indicates a classification error and indicates the transmitting node as being different from the nominal node.

3. The method as set forth in claim 1 , wherein, if the second check has a negative outcome, the classification operation further includes the step of indicating a masquerade attack.

4. The method as set forth in claim 1 , wherein, if the third check has a negative outcome, the classification operation indicates further the step of indicating a fabrication attack.

5. The method as set forth in claim 1 , wherein said classification operation is an operation of decisional logic discrimination in which the result of the first check as to whether the correlation coefficient is higher than a first given threshold is evaluated first, and the result of the second check and/or the result of the third check are/is evaluated if the result of the first check is affirmative.

6. The method as set forth in claim 1 , wherein information known a priori, concerning the topology of the network and/or the transmitting nodes and/or the number and type of identifier of the messages transmitted by each of said nodes, is accessible for performing the operations of the method.

7. The method as set forth in claim 1 , which further includes an operation of filtering with white list, which accepts only the message identifiers actually present in said white list associated to the control node.

8. The method as set forth in claim 1 , wherein said operation of measuring arrival times is performed by acquiring the timestamp of arrival of the messages.

9. A device for protection from cyber attacks in a communication network, in particular a CAN (Controller Area Network), of a vehicle, said network comprising:

a communication bus, in particular a CAN-bus, and

a plurality of nodes associated to said communication bus in a signal-exchange relationship and associated at least in part to control units for controlling functions of the vehicle,

said nodes exchanging messages passing between nodes of said plurality of nodes, and

said messages being identified by respective message identifiers,

wherein said device is configured to operate according to the method as set forth in claim 1 .