System for anomaly detection on can bus data with sparse and low rank decomposition of transfer entropy matrix

Abstract

Described is a system for detecting cyber intrusions based on analysis of network traffic. During operation, the system performs a statistical analysis of message timing on network traffic to produce a temporal dependency matrix representative of temporal dependency between different message types in the network traffic. The sets of temporal dependency matrices are decomposed into component matrices, where at least one component matrix represents typical properties of these matrices and at least one other component matrix represents atypical properties of the matrices. A new temporal dependency matrix is generated based on new network traffic. Finally, anomalous behavior is detected in the new network traffic by comparing component matrices of the new temporal dependency matrix with component matrices of the temporal dependency matrices under normal operation conditions.