Marelli Europe S.p.a.

Christian Rosadini

Walter Nesci

Sergio Saponara

Alessio Gagliardi

Pierpaolo Dini

Anastasia Cornelio

Simona Chiarelli

Paola De Cesare

A method for protection from cyber attacks in a CAN (Controller Area Network), of a vehicle including the steps of selecting periodic messages having a transmission periodicity, grouping the periodic messages, and performing an analysis of messages of the nodes that exchange the received periodic messages, which includes obtaining times of arrival at the respective nodes of a set of periodic messages that have the same message identifier, computing average-offset values over successive subsets, of a given number of messages, accumulating the average-offset values for each identifier to obtain accumulated-offset values, identifying linear parameters by computing an angular coefficient, of a regression, and an intercept, or identification error, computing a correlation coefficient of the average offset of pairs of messages identified as coming from the same node, determining whether the correlation coefficient is higher than a first given threshold, determining whether the angular coefficient between two consecutive messages with the same identifier is higher than a second given threshold, determining whether the intercept between two consecutive messages is higher than a third given threshold, and supplying the results of these determinations to a message-classification operation.

Method for protection from cyber attacks to a vehicle based upon time analysis, and corresponding device

A method for protection from cyber attacks in a communication network of a vehicle comprising: the steps of building sets of dominant voltage measurements for each message identifier associated to a message that is passing; extracting statistical features; supplying the statistical features for each message identifier that are available at each instant at input to a neural network of a pattern-recognition type; carrying out an operation of classification, or pattern recognition, supplying a prediction of a membership class corresponding to a given node on the basis of the statistical features supplied at input; evaluating whether the prediction supplied by the neural network corresponds to a given node that allows as admissible message identifier the message identifier at input and, if it does not, signalling an anomaly for the message identifier; and evaluating whether a number of anomalies signalled for said message identifier exceeds a given threshold.

Method for protection from cyber attacks to a vehicle, and corresponding device

Growing community of inventors

Corbetta, Italy

Christian Rosadini