Abstract: A system and method for detecting cyber threats in a vehicle may detecting an event related to exploitation of a component connected to an in-vehicle network based on a deviation of execution of executable code from a reference execution behavior. A deviation may be detected based on a set of whitelists and blacklists. An event related to a deviation may be recorded.

Abstract: A system and method for providing fleet cyber-security comprising may include collecting, by a plurality of data collection units installed in a respective plurality of vehicles in the fleet, information related to cyber security and including the information in reports to a server. Data in reports may be aggregated, by the server. A cyber-attack may be identified based on aggregated data.

Abstract: A system or method may include an in-vehicle network including an interface port for connecting an external device to the in-vehicle network; and a security unit connected to the in-vehicle network, the security unit adapted to enable an external device to communicate with the in-vehicle network, over the interface port, based on a security token received from the external device. A system or method may, based on a token, prevent an external device from at least one of: communicating with a selected set of components on in an in-vehicle network, communicating with a selected set of network segments in the in-vehicle network and performing a selected set of operations.

Abstract: A system for providing security to a fleet of vehicles, the system comprising: a plurality of modules, each module configured to monitor messages propagating in an in-vehicle network of a vehicle comprised in the fleet; a memory having data characterizing messages, and software executable to: identify an anomaly in communications over the in-vehicle communication network; and instruct a communication interface, configured to support communication with an entity external to the vehicle, to transmit monitoring data responsive to the messages; and a processor configured to execute the software in the memory; and a data monitoring and processing hub external to the vehicles comprised in the fleet and operable to receive transmission of monitoring data from the plurality of modules.

Abstract: An in-vehicle communication network comprising a bus and at least one node connected to the bus; an in-vehicle network operating system (OS) that manages OS processes, to enable a processor to run the processes and execute their respective process codes; and a module hosted in the OS that is configured to monitor the OS and vet a process that the OS enables for running by a processor to determine if the process is potentially damaging.

Abstract: A system or method may include an in-vehicle network including an interface port for connecting an external device to the in-vehicle network; and a security unit connected to the in-vehicle network, the security unit adapted to enable an external device to communicate with the in-vehicle network, over the interface port, based on a security token received from the external device. A system or method may, based on a token, prevent an external device from at least one of: communicating with a selected set of components on in an in-vehicle network, communicating with a selected set of network segments in the in-vehicle network and performing a selected set of operations.

Abstract: A system and method securing an in-vehicle network in a vehicle may include a switch connected to at least two segments of the in-vehicle network and an IDPS connected to the switch. The IDPS unit may be adapted to: receive network messages from the switch; determine at least some of the network messages are related to a cyber threat and configure the switch according to the cyber threat. The IDPS unit may be included in the switch.

Abstract: Systems and methods for detection of attacks on a communication authentication layer of an in-vehicle network, including determining, by at least one network node, at least one attack attempt on the communication authentication layer of the in-vehicle network, wherein the determination is carried out by identifying anomalies in at least one of messages, data and metadata directed to the communication authentication layer, and selecting, by the at least one network node, a response corresponding to the determined attack attempt from at least one of modification of parameter values corresponding to a security protocol, a failsafe response, and rejection of messages identified as anomalies.

Abstract: A system and method for providing security to a network may include maintaining, by a processor, a model of an expected behavior of data communications over the in-vehicle communication network; receiving, by the processor, a message sent over the network; determining, by the processor, based on the model and based on a timing attribute of the message, whether or not the message complies with the model; and if the message does not comply with the model then performing, by the processor, at least one action related to the message.

Abstract: A system and method for providing security to a network may include maintaining, by a processor, a model of an expected behavior of data communications over an in-vehicle communication network; receiving, by the processor, a plurality of messages communicated over the network; determining, by the processor, based on the model and based on content attributes of the plurality of messages, whether or not at least one of the messages complies with the model; and if at least one message does not comply with the model then performing, by the processor, at least one action related to the message.

Abstract: A method of providing an alert of an occurrence of a hacker intrusion, the method comprising: detecting a hacker intrusion; and transmitting a concealed or camouflaged report of the hacker intrusion to provide an alert of the occurrence of the intrusion.

Abstract: A system and method for providing security to a network may include identifying a message sent over a network, the message related to a data transfer from an initiator to a target node, and transmitting, over the network, at least one disruptive message that causes the data transfer to fail.

Abstract: A system and method for providing security to a network may include maintaining, by a processor, a model of an expected behavior of data communications over the in-vehicle communication network; receiving, by the processor, a message sent over the network; determining, by the processor, based on the model and based on content in the message, whether or not the message complies with the model; and if the message does not comply with the model then performing, by the processor, at least one action related to the message.

Abstract: An in-vehicle communication network comprising at least one node connected to a bus, the network comprising: at least one memory comprising software having data characterizing messages that propagate over the network during normal operation and executable instructions for processing a message based on the data to determine if the message is normal or anomalous; a module operable to: process messages received from the in-vehicle network in accordance with the executable instructions and the data to identify an anomaly in communications over the in-vehicle communication network; accumulate and store information responsive to the processing of the received messages; instruct a communication interface, configured to support communication with an entity external to the vehicle, to upload the stored information or a portion thereof to the entity external to the in-vehicle network.

Abstract: A system and method for providing security to a network may include maintaining, by a processor, a model of an expected behavior of data communications over the in-vehicle communication network; receiving, by the processor, a message sent over the network; determining, by the processor, based on the model and based on content in the message, whether or not the message complies with the model; and if the message does not comply with the model then performing, by the processor, at least one action related to the message.

Abstract: A method of determining if a vehicle's performance has been modified, the method comprising: acquiring operational data comprised in communications signals transmitted over a vehicle's in-vehicle network during operation of the vehicle; processing the operational data to determine an operational profile for the vehicle that characterizes actual operation of the vehicle; and determining based on the operational profile if the vehicle performance has undergone modification.

Abstract: A system and method for providing security to a network may include monitoring, by a processor, traffic on a first and second network portions of an in-vehicle communication network; determining whether or not a first message detected on the first network portion is anomalous based on at least one of: an attribute of a second message detected on the second network portion and an absence of a second message from the second network portion over a predefined time period; and, if it is determined the first message is anomalous then performing at least one action.

Abstract: A module for providing security to a vehicle's in-vehicle communication network that is responsive to an operational state of the vehicle.

Abstract: A method of identifying a node of a plurality of nodes in an in-vehicle communications network that transmitted a waveform propagating in the network, comprising comparing a fingerprint generated for the propagating voltage waveform with a library having library fingerprints that are unique for waveforms transmitted by each node to determine which node transmitted the waveform.

Abstract: A system and method for detecting cyber threats in a vehicle may detecting an event related to exploitation of a component connected to an in-vehicle network based on a deviation of execution of executable code from a reference execution behavior. A deviation may be detected based on a set of whitelists and blacklists. An event related to a deviation may be recorded.