Abstract: A system for generating a set of rules for detecting Controller Area Network (CAN) messages anomalies, the system comprising a processing resource configured to: obtain a training set including a plurality of CAN messages, each CAN message having properties; train a model, using the training set, the model characterizing statistical relationships between one or more first types of CAN messages of respective first CAN message type and one or more second types of CAN messages each of respective second CAN message type, wherein the statistical relationships are based on one or more of the properties of the CAN messages of the training set; wherein the model is usable for identifying anomalies within a sequence of input CAN messages.

Abstract: A model configuration selection system, the model configuration selection system comprising a processing circuitry configured to: (A) obtain: (a) one or more model configurations, each model configuration includes a set of parameters utilized to generate respective models, and (b) a training data-set comprising a plurality of unlabeled records, each unlabeled record including a collection of features describing a given state of a physical entity; (B) cluster the training data-set into two or more training data-set clusters using a clustering algorithm; (C) label (a) the unlabeled records of a subset of the training data-set clusters with a synthetic normal label, giving rise to a normal training data-set, and (b) the unlabeled records of the training data-set clusters not included in the subset with a synthetic abnormal label; (D) train, for each model configuration, using the normal training data-set, a corresponding model utilizing the corresponding set of parameters, each model capable of receiving the unl

Abstract: A computer implemented method of reducing a size of a message intercepted on a communication channel of a vehicle, comprising using one or more processors of a vehicular device. The processor(s) is adapted for receiving one or more of a plurality of messages intercepted by one or more devices adapted to monitor messages transmitted via one or more segments of one or more communication channels of a vehicle, applying one or more trained machine learning models to identify one or more of a plurality of data patterns in one or more of the messages, adjusting one or more of the messages by replacing each of the identified data pattern(s) with a respective predefined lossless representation having a reduced size compared to the identified data pattern and transmitting the adjusted message(s) to a remote system via one or more upload communication channels.

Abstract: A system for compressing Controller Area Network (CAN) messages, the system comprising a processing resource configured to: obtain a CAN messages sequence including a plurality of CAN messages intercepted at a given order by at least one device adapted to monitor messages transmitted via communication channel(s) of a vehicle; group the CAN messages of the CAN messages sequence into MID groups, by a CAN MID field of the CAN messages; for each given MID group of the MID groups split the CAN messages of the MID group into field groups, wherein each field group comprises a respective field of a plurality of fields of the CAN messages of the MID group; employ at least one compression scheme on at least one of the field groups; generate a data structure comprising the field groups; and compress the data structure using a lossless compression algorithm, giving rise to a compressed data structure.

Abstract: A computer implemented method of identifying an abnormal event in an operational environment of a vehicle, comprising using one or more processors adapted for receiving a plurality of messages intercepted by one or more devices adapted to monitor messages transmitted via one or more segments of one or more communication channels of a vehicle, applying a plurality of trained machine learning models to evaluate compliance of each of the intercepted messages with one or more baseline models according to feature(s) identified for each intercepted message, the baseline model(s) defining learned message patterns is created by training the plurality of machine learning models with a plurality of training datasets comprising training messages reflecting valid operation of the vehicle, identifying incompliant intercepted message(s) which is incompliant with the baseline model(s), the incompliant message(s) is transmitted as result of one or more abnormal event and generating an alert indicative of the abnormal event(s

Abstract: An executable memory page validation system for validating one or more executable memory pages on a given endpoint, the executable memory page validation system comprising at least one processing resource configured to: obtain a plurality of vectors, each vector of the vectors being a bitmask indicative of valid hash values calculated for a plurality of executable memory pages available on the endpoint, the valid hash values being calculated using a respective distinct hash function; calculate one or more validation hash values for a given executable memory page to be loaded to a computerized memory of the endpoint for execution thereof, using one or more selected hash functions of the distinct hash functions; and determine that the given executable memory page is invalid, upon one or more of the validation hash values not being indicated as valid in the corresponding one or more vectors.

Abstract: A computer implemented method of reducing a size of a message intercepted on a communication channel of a vehicle, comprising using one or more processors of a vehicular device. The processor(s) is adapted for receiving one or more of a plurality of messages intercepted by one or more devices adapted to monitor messages transmitted via one or more segments of one or more communication channels of a vehicle, applying one or more trained machine learning models to identify one or more of a plurality of data patterns in one or more of the messages, adjusting one or more of the messages by replacing each of the identified data pattern(s) with a respective predefined lossless representation having a reduced size compared to the identified data pattern and transmitting the adjusted message(s) to a remote system via one or more upload communication channels.

Abstract: A computer implemented method of identifying an abnormal event in an operational environment of a vehicle, comprising using one or more processors adapted for receiving a plurality of messages intercepted by one or more devices adapted to monitor messages transmitted via one or more segments of one or more communication channels of a vehicle, applying a plurality of trained machine learning models to evaluate compliance of each of the intercepted messages with one or more baseline models according to feature(s) identified for each intercepted message, the baseline model(s) defining learned message patterns is created by training the plurality of machine learning models with a plurality of training datasets comprising training messages reflecting valid operation of the vehicle, identifying incompliant intercepted message(s) which is incompliant with the baseline model(s), the incompliant message(s) is transmitted as result of one or more abnormal event and generating an alert indicative of the abnormal event(s

Abstract: A computerized method of evaluating authenticity of automotive devices, comprising a local authorization entity (AE) adapted to manage identity authentication for a group of automotive devices located in an associated geographical area. The local AE provides, to a first automotive device of the group, an AE identity certificate comprising an encryption key of the local AE and signed with a higher level AE's encryption key. The first automotive device uses the higher level AE's encryption key to decrypt the AE identity certificate and retrieve the local AE's encryption key. The first automotive device uses the local AE's encryption key to verify an identity certificate created by the local AE for a second automotive device of the group. The first automotive device establishes a session with the second automotive device according to an identity posture score extracted from the identity certificate of the second automotive device.

Abstract: A computerized method of evaluating authenticity of automotive devices, comprising a local authorization entity (AE) adapted to manage identity authentication for a group of automotive devices located in an associated geographical area. The local AE provides, to a first automotive device of the group, an AE identity certificate comprising an encryption key of the local AE and signed with a higher level AE's encryption key. The first automotive device uses the higher level AE's encryption key to decrypt the AE identity certificate and retrieve the local AE's encryption key. The first automotive device uses the local AE's encryption key to verify an identity certificate created by the local AE for a second automotive device of the group. The first automotive device establishes a session with the second automotive device according to an identity posture score extracted from the identity certificate of the second automotive device.