Systems and methods for sequential anomaly detection in ivns using a graph-based state space approach

Abstract

A method of operating an anomaly detection system includes receiving training message sequences corresponding to messages transmitted in an in-vehicle network (IVN), constructing, based on the training message sequences, a model that includes a plurality of states corresponding to observed signal values in the training message sequences and state transitions between respective states of the plurality of states, training the model by supplying, to the model, first messages sequences corresponding to the training message sequences and second message sequences not contained in the training message sequences, and, using the anomaly detection system, executing the model to identify anomalous message sequences transmitted in the IVN by receiving an IVN message sequence, outputting, from the model, a value based on state transitions between states of signals contained in the IVN message sequence, and outputting, based on the value, an indication of whether the IVN message sequence includes an anomalous message sequence.