SYSTEM AND METHOD FOR CONTENT BASED ANOMALY DETECTION IN AN IN-VEHICLE COMMUNICATION NETWORK

摘要

A system and method for providing security to a network may include maintaining, by a processor, a model of an expected behavior of data communications over the in-vehicle communication network; receiving, by the processor, a message sent over the network; determining, by the processor, based on the model and based on content in the message, whether or not the message complies with the model; and if the message does not comply with the model then performing, by the processor, at least one action related to the message.

主权项

1. A system including a non-transitory computer readable medium including instructions that, when executed by at least one processor, cause the at least one processor to perform content-based cyber-security operations, the operations including:
maintaining a content model of an expected behavior of data communications over an in-vehicle communication network; receiving a plurality of messages communicated over the network; determining, based on the content model and based on content attributes of the plurality of messages, whether or not at least one of the messages complies with the content model; and if at least one message does not comply with the content model then performing, by the processor, at least one action related to the message.