Abstract: A method for protection from cyber attacks in a vehicle communication network including the steps of executing a protection and monitoring procedure comprising: a learning step that includes: acquiring sets ({right arrow over (V)}IDk) of values of times of arrival (TSIDk) of messages (MSG) exchanged on the network, ordered according to a respective message identifier (IDk), computing one or more statistical parameters (?IDk, sIDk2) of the sets of arrival-time values (TSIDk), and subsequently obtaining statistical parameters ({right arrow over (?)}IDk) of confidence windows for one or more statistical parameters (?IDk, sIDk2) of the sets of arrival-time values (TS?IDk); and a subsequent classification and anomaly-detection step that includes: acquiring sets ({right arrow over (u)}IDk) of values of times of arrival (TS?IDk) at the device of messages (MSG?), computing corresponding one or more statistical parameters (??IDk,s?IDk2) of the sets of arrival-time values (TS?IDk) to obtain votes (V,W) of membership of

Abstract: A method for protection from cyber attacks in a CAN (Controller Area Network), of a vehicle including the steps of selecting periodic messages having a transmission periodicity, grouping the periodic messages, and performing an analysis of messages of the nodes that exchange the received periodic messages, which includes obtaining times of arrival at the respective nodes of a set of periodic messages that have the same message identifier, computing average-offset values over successive subsets, of a given number of messages, accumulating the average-offset values for each identifier to obtain accumulated-offset values, identifying linear parameters by computing an angular coefficient, of a regression, and an intercept, or identification error, computing a correlation coefficient of the average offset of pairs of messages identified as coming from the same node, determining whether the correlation coefficient is higher than a first given threshold, determining whether the angular coefficient between two consec

Abstract: A method for protection from cyber attacks in a communication network of a vehicle comprising: the steps of building sets of dominant voltage measurements for each message identifier associated to a message that is passing; extracting statistical features; supplying the statistical features for each message identifier that are available at each instant at input to a neural network of a pattern-recognition type; carrying out an operation of classification, or pattern recognition, supplying a prediction of a membership class corresponding to a given node on the basis of the statistical features supplied at input; evaluating whether the prediction supplied by the neural network corresponds to a given node that allows as admissible message identifier the message identifier at input and, if it does not, signalling an anomaly for the message identifier; and evaluating whether a number of anomalies signalled for said message identifier exceeds a given threshold.