Abstract: A method that includes operating a bus monitoring system having at least one interface configured to be coupled to at least one communication bus and receive bus traffic transmitted over the communication bus(es). The method also includes, using a device authentication system of the bus monitoring system, analyzing the bus traffic received via the at least one interface. Analyzing the bus traffic includes obtaining a message in the bus traffic (where the message identifies a source), identifying a support vector machine that corresponds to the source of the message, applying a wave transform to a waveform of the received message in order to generate a transformed waveform, inputting the transformed waveform to the identified support vector machine, and taking action in response to the identified support vector machine determining that the transformed waveform or the associated information does not correspond to the source.

Abstract: A process detects anomalies on a controller area network (CAN) bus. An arbitration field in a message on the CAN bus is analyzed, and a data field in the message on the CAN bus is inspected. The process further monitors a frequency of message identifiers that are transmitted across the CAN bus, and determines that an overall bus load crosses a threshold. The process then transmits an alert when the analyzing the arbitration field, the inspecting the data field, the monitoring the frequency, and the determining the overall bus load indicate that an anomaly has occurred on the CAN bus.

Abstract: A process detects anomalies on a controller area network (CAN) bus. An arbitration field in a message on the CAN bus is analyzed, and a data field in the message on the CAN bus is inspected. The process further monitors a frequency of message identifiers that are transmitted across the CAN bus, and determines that an overall bus load crosses a threshold. The process then transmits an alert when the analyzing the arbitration field, the inspecting the data field, the monitoring the frequency, and the determining the overall bus load indicate that an anomaly has occurred on the CAN bus.

Abstract: A method that includes operating a bus monitoring system having at least one interface configured to be coupled to at least one communication bus and receive bus traffic transmitted over the communication bus(es). The method also includes, using a device authentication system of the bus monitoring system, analyzing the bus traffic received via the at least one interface. Analyzing the bus traffic includes obtaining a message in the bus traffic (where the message identifies a source), identifying a support vector machine that corresponds to the source of the message, applying a wave transform to a waveform of the received message in order to generate a transformed waveform, inputting the transformed waveform to the identified support vector machine, and taking action in response to the identified support vector machine determining that the transformed waveform or the associated information does not correspond to the source.