Abstract: A method for protection from cyber attacks in a vehicle communication network including the steps of executing a protection and monitoring procedure comprising: a learning step that includes: acquiring sets ({right arrow over (V)}IDk) of values of times of arrival (TSIDk) of messages (MSG) exchanged on the network, ordered according to a respective message identifier (IDk), computing one or more statistical parameters (?IDk, sIDk2) of the sets of arrival-time values (TSIDk), and subsequently obtaining statistical parameters ({right arrow over (?)}IDk) of confidence windows for one or more statistical parameters (?IDk, sIDk2) of the sets of arrival-time values (TS?IDk); and a subsequent classification and anomaly-detection step that includes: acquiring sets ({right arrow over (u)}IDk) of values of times of arrival (TS?IDk) at the device of messages (MSG?), computing corresponding one or more statistical parameters (??IDk,s?IDk2) of the sets of arrival-time values (TS?IDk) to obtain votes (V,W) of membership of

Abstract: A method for protection from cyber attacks in a CAN (Controller Area Network), of a vehicle including the steps of selecting periodic messages having a transmission periodicity, grouping the periodic messages, and performing an analysis of messages of the nodes that exchange the received periodic messages, which includes obtaining times of arrival at the respective nodes of a set of periodic messages that have the same message identifier, computing average-offset values over successive subsets, of a given number of messages, accumulating the average-offset values for each identifier to obtain accumulated-offset values, identifying linear parameters by computing an angular coefficient, of a regression, and an intercept, or identification error, computing a correlation coefficient of the average offset of pairs of messages identified as coming from the same node, determining whether the correlation coefficient is higher than a first given threshold, determining whether the angular coefficient between two consec

Abstract: A method for protecting against cyber attacks in a communication network of a vehicle, including the steps of acquiring dominant voltage measurements; obtaining an electrical characteristic of nodes that transmit messages by acquiring consecutive groups of voltage measurements at receiving nodes and calculating a distribution thereof; calculating values of distribution statistics; calculating a cumulative voltage deviation for each value of statistic; and obtaining a voltage profile by adding the cumulative voltage deviations of each statistic, executing a malicious-node detection procedure and then executing a transmitting-node identification procedure including comparing the at least one characteristic parameter against all the corresponding characteristic parameters of all the messages, defining a range of variation of the characteristic parameter with respect to a given number of previous samples; and evaluating whether the value of the parameter falls within the range of variation of one of the messages