Abstract: A method for protection from cyber attacks in a vehicle communication network including the steps of executing a protection and monitoring procedure comprising: a learning step that includes: acquiring sets ({right arrow over (V)}IDk) of values of times of arrival (TSIDk) of messages (MSG) exchanged on the network, ordered according to a respective message identifier (IDk), computing one or more statistical parameters (?IDk, sIDk2) of the sets of arrival-time values (TSIDk), and subsequently obtaining statistical parameters ({right arrow over (?)}IDk) of confidence windows for one or more statistical parameters (?IDk, sIDk2) of the sets of arrival-time values (TS?IDk); and a subsequent classification and anomaly-detection step that includes: acquiring sets ({right arrow over (u)}IDk) of values of times of arrival (TS?IDk) at the device of messages (MSG?), computing corresponding one or more statistical parameters (??IDk,s?IDk2) of the sets of arrival-time values (TS?IDk) to obtain votes (V,W) of membership of

Abstract: A method for protection from cyber attacks in a communication network of a vehicle comprising: the steps of building sets of dominant voltage measurements for each message identifier associated to a message that is passing; extracting statistical features; supplying the statistical features for each message identifier that are available at each instant at input to a neural network of a pattern-recognition type; carrying out an operation of classification, or pattern recognition, supplying a prediction of a membership class corresponding to a given node on the basis of the statistical features supplied at input; evaluating whether the prediction supplied by the neural network corresponds to a given node that allows as admissible message identifier the message identifier at input and, if it does not, signalling an anomaly for the message identifier; and evaluating whether a number of anomalies signalled for said message identifier exceeds a given threshold.

Abstract: A method for protecting against cyber attacks in a communication network of a vehicle, including the steps of acquiring dominant voltage measurements; obtaining an electrical characteristic of nodes that transmit messages by acquiring consecutive groups of voltage measurements at receiving nodes and calculating a distribution thereof; calculating values of distribution statistics; calculating a cumulative voltage deviation for each value of statistic; and obtaining a voltage profile by adding the cumulative voltage deviations of each statistic, executing a malicious-node detection procedure and then executing a transmitting-node identification procedure including comparing the at least one characteristic parameter against all the corresponding characteristic parameters of all the messages, defining a range of variation of the characteristic parameter with respect to a given number of previous samples; and evaluating whether the value of the parameter falls within the range of variation of one of the messages

Abstract: A method for monitoring the data traffic over a CAN bus of a CAN-type communication network of a motor vehicle. The network includes a plurality of nodes associated to said CAN bus in a signal-exchange relationship in order to detect data traffic with anomalies and generate an alert. The method includes the steps of carrying out at each node an intrusion-detection operation on messages received at said node and a corresponding vehicle-recovery operation. The intrusion-detection operation includes receiving CAN messages or groups of CAN messages transmitted to the node on the CAN bus, analysing the CAN messages or groups of CAN messages, and issuing an alert comprising a type of anomaly that has caused the alert. The vehicle-recovery operation includes implementing, on the basis of said type of anomaly, a corresponding intrusion-recovery action.