Method for protection from cyber attacks to a vehicle based upon time analysis, and corresponding device

Abstract

A method for protection from cyber attacks in a vehicle communication network including the steps of executing a protection and monitoring procedure comprising: a learning step that includes: acquiring sets ({right arrow over (V)}) of values of times of arrival (TS) of messages (MSG) exchanged on the network, ordered according to a respective message identifier (ID), computing one or more statistical parameters of the sets of arrival-time values (TS), and subsequently obtaining statistical parameters ({right arrow over (ω)}ID) of confidence windows for one or more statistical parameters of the sets of arrival-time values (TS'); and a subsequent classification and anomaly-detection step that includes: acquiring sets ({right arrow over (u)}) of values of times of arrival (TS′) at the device of messages (MSG′), computing corresponding one or more statistical parameters of the sets of arrival-time values (TS') to obtain votes (V,W) of membership of the statistical parameters of the sets of arrival-time values (TS') in confidence windows of the sets of arrival-time values (TS′), and evaluating issuing of malicious-message alarms (AL) on the basis of the membership votes (V, W).