Abstract: A system for generating a set of rules for detecting Controller Area Network (CAN) messages anomalies, the system comprising a processing resource configured to: obtain a training set including a plurality of CAN messages, each CAN message having properties; train a model, using the training set, the model characterizing statistical relationships between one or more first types of CAN messages of respective first CAN message type and one or more second types of CAN messages each of respective second CAN message type, wherein the statistical relationships are based on one or more of the properties of the CAN messages of the training set; wherein the model is usable for identifying anomalies within a sequence of input CAN messages.

Abstract: A system comprising a processing circuitry configured to: obtain one or more MLIPs, each comprised of a sequence of one or more Data Processing Elements (DPEs), and each having (a) at least one input provided to the respective DPE, and (b) at least one output provided by the respective DPE, wherein the output of a given DPE of the DPEs, is the input of a subsequent DPE of the sequence, and wherein at least one of the DPEs is a trained machine learning model; generate, for each of the MLIPs, a respective pipeline representation comprising representations of the sequence, based on the DPEs, the inputs of the DPEs, and the outputs of the DPEs; merge the plurality of MLIP representations into a common representation; optimize the common representation; and generate, based on the common representation, a target model consuming less resources than the MLIPs.

Abstract: A computer implemented method of reducing a size of a message intercepted on a communication channel of a vehicle, comprising using one or more processors of a vehicular device. The processor(s) is adapted for receiving one or more of a plurality of messages intercepted by one or more devices adapted to monitor messages transmitted via one or more segments of one or more communication channels of a vehicle, applying one or more trained machine learning models to identify one or more of a plurality of data patterns in one or more of the messages, adjusting one or more of the messages by replacing each of the identified data pattern(s) with a respective predefined lossless representation having a reduced size compared to the identified data pattern and transmitting the adjusted message(s) to a remote system via one or more upload communication channels.

Abstract: A system for compressing Controller Area Network (CAN) messages, the system comprising a processing resource configured to: obtain a CAN messages sequence including a plurality of CAN messages intercepted at a given order by at least one device adapted to monitor messages transmitted via communication channel(s) of a vehicle; group the CAN messages of the CAN messages sequence into MID groups, by a CAN MID field of the CAN messages; for each given MID group of the MID groups split the CAN messages of the MID group into field groups, wherein each field group comprises a respective field of a plurality of fields of the CAN messages of the MID group; employ at least one compression scheme on at least one of the field groups; generate a data structure comprising the field groups; and compress the data structure using a lossless compression algorithm, giving rise to a compressed data structure.

Abstract: A feature selection recommendation system, the feature selection recommendation system comprising a processing circuitry configured to: obtain: (a) a training data-set, the training data-set comprising a plurality of records, each record including a collection of features describing a given allowed state of a physical entity, and (b) a selection of one or more selected features of the features; generate, using a causality discovery model, for a plurality of pairs of the features of the training data-set, a respective causality score, the causality score being indicative of an influence between the features of the respective pair; identify additional recommended features, being one or more features that comply with a recommendation condition based on the plurality of pairs and the causality scores generated for the pairs; and provide a user of the feature selection recommendation system with an indication of the additional recommended features.

Abstract: A physics-based model machine learning system, the physics-based model machine learning system comprising a processing circuitry configured to: obtain: (a) a training data-set, the training data-set comprising a plurality of training records, each training record including a collection of features describing a given allowed state of a physical entity, and (b) one or more physical models, modeling allowed physical patterns associated with the physical entity; enrich the training data-set by determining values of one or more unobservable features for one or more given training records of the training records, wherein the unobservable features are determined utilizing at least one of the physical models and at least one of the features of the respective given training records, giving rise to an enriched training data-set; train, using the enriched training data-set, a machine learning model capable of receiving one or more inference records, and determining, for each of the inference records, a corresponding nor

Abstract: A computer implemented method of identifying an abnormal event in an operational environment of a vehicle, comprising using one or more processors adapted for receiving a plurality of messages intercepted by one or more devices adapted to monitor messages transmitted via one or more segments of one or more communication channels of a vehicle, applying a plurality of trained machine learning models to evaluate compliance of each of the intercepted messages with one or more baseline models according to feature(s) identified for each intercepted message, the baseline model(s) defining learned message patterns is created by training the plurality of machine learning models with a plurality of training datasets comprising training messages reflecting valid operation of the vehicle, identifying incompliant intercepted message(s) which is incompliant with the baseline model(s), the incompliant message(s) is transmitted as result of one or more abnormal event and generating an alert indicative of the abnormal event(s

Abstract: A system for generating a set of rules for detecting Controller Area Network (CAN) messages anomalies, the system comprising a processing resource configured to: obtain a training set including a plurality of CAN messages, each CAN message having properties; train a model, using the training set, the model characterizing statistical relationships between one or more first types of CAN messages of respective first CAN message type and one or more second types of CAN messages each of respective second CAN message type, wherein the statistical relationships are based on one or more of the properties of the CAN messages of the training set; wherein the model is usable for identifying anomalies within a sequence of input CAN messages.

Abstract: A system for identifying one or more sub-fields within a field of a given field type, the field comprising a plurality of field bits, and each of the sub-fields comprising a distinct sub-group of the field bits having one or more fixed consecutive bit positions within each instance of a plurality of instances of the field, the system including a processing resource configured to: obtain one or more input time-series, each input time-series of the one or more input time-series including a plurality of input instances of the field; generate one or more 10 new time-series, each new time-series of the generated new time-series being associated with at least one input time-series of the one or more input time-series and including a plurality of new instances of the field; generate a bit-field based on selected instances of the new instances in each new time-series of the generated new time-series; and analyze the bit-field to identify the fixed consecutive bit positions of at least one of the sub-fields within the

Abstract: A system for compressing Controller Area. Network (CAN) messages, the system comprising a processing resource configured to: obtain a CAN messages sequence including a plurality of CAN messages intercepted at a given order by at least one device adapted to monitor messages transmitted via communication channel(s) of a vehicle; group the CAN messages of the CAN messages sequence into MID groups, by a CAN MID field of the CAN messages; for each given MID group of the MID groups split the CAN messages of the MID group into field groups, wherein each field group comprises a respective field of a plurality of to fields of the CAN messages of the MID group; employ at least one compression scheme on at least one of the field groups; generate a data structure comprising the field groups; and compress the data structure using a lossless compression algorithm, giving rise to a. compressed data structure.

Abstract: An executable memory page validation system for validating one or more executable memory pages on a given endpoint, the executable memory page validation system comprising at least one processing resource configured to: obtain a plurality of vectors, each vector of the vectors being a bitmask indicative of valid hash values calculated for a plurality of executable memory pages available on the endpoint, the valid hash values being calculated using a respective distinct hash function; calculate one or more validation hash values for a given executable memory page to be loaded to a computerized memory of the endpoint for execution thereof, using one or more selected hash functions of the distinct hash functions; and determine that the given executable memory page is invalid, upon one or more of the validation hash values not being indicated as valid in the corresponding one or more vectors.

Abstract: A system for identifying one or more sub-fields within a field of a given field type, the field comprising a plurality of field bits, and each of the sub-fields comprising a distinct sub-group of the field bits having one or more fixed consecutive bit positions within each instance of a plurality of instances of the field, the system including a processing resource configured to: obtain one or more input time-series, each input time-series of the one or more input time-series including a plurality of input instances of the field; generate one or more new time-series, each new time-series of the generated new time-series being associated with at least one input time-series of the one or more input time-series and including a plurality of new instances of the field; generate a bit-field based on selected instances of the new instances in each new time-series of the generated new time-series; and analyze the bit-field to identify the fixed consecutive bit positions of at least one of the sub-fields within the fi

Abstract: An executable memory page validation system for validating one or more executable memory pages on a given endpoint, the executable memory page validation system comprising at least one processing resource configured to: obtain a plurality of vectors, each vector of the vectors being a bitmask indicative of valid hash values calculated for a plurality of executable memory pages available on the endpoint, the valid hash values being calculated using a respective distinct hash function; calculate one or more validation hash values for a given executable memory page to be loaded to a computerized memory of the endpoint for execution thereof, using one or more selected hash functions of the distinct hash functions; and determine that the given executable memory page is invalid, upon one or more of the validation hash values not being indicated as valid in the corresponding one or more vectors.

Abstract: A computer implemented method of reducing a size of a message intercepted on a communication channel of a vehicle, comprising using one or more processors of a vehicular device. The processor(s) is adapted for receiving one or more of a plurality of messages intercepted by one or more devices adapted to monitor messages transmitted via one or more segments of one or more communication channels of a vehicle, applying one or more trained machine learning models to identify one or more of a plurality of data patterns in one or more of the messages, adjusting one or more of the messages by replacing each of the identified data pattern(s) with a respective predefined lossless representation having a reduced size compared to the identified data pattern and transmitting the adjusted message(s) to a remote system via one or more upload communication channels.

Abstract: A computer implemented method of identifying an abnormal event in an operational environment of a vehicle, comprising using one or more processors adapted for receiving a plurality of messages intercepted by one or more devices adapted to monitor messages transmitted via one or more segments of one or more communication channels of a vehicle, applying a plurality of trained machine learning models to evaluate compliance of each of the intercepted messages with one or more baseline models according to feature(s) identified for each intercepted message, the baseline model(s) defining learned message patterns is created by training the plurality of machine learning models with a plurality of training datasets comprising training messages reflecting valid operation of the vehicle, identifying incompliant intercepted message(s) which is incompliant with the baseline model(s), the incompliant message(s) is transmitted as result of one or more abnormal event and generating an alert indicative of the abnormal event(s

Abstract: A computerized method of evaluating authenticity of automotive devices, comprising a local authorization entity (AE) adapted to manage identity authentication for a group of automotive devices located in an associated geographical area. The local AE provides, to a first automotive device of the group, an AE identity certificate comprising an encryption key of the local AE and signed with a higher level AE's encryption key. The first automotive device uses the higher level AE's encryption key to decrypt the AE identity certificate and retrieve the local AE's encryption key. The first automotive device uses the local AE's encryption key to verify an identity certificate created by the local AE for a second automotive device of the group. The first automotive device establishes a session with the second automotive device according to an identity posture score extracted from the identity certificate of the second automotive device.

Abstract: A computerized method of evaluating authenticity of automotive devices, comprising a local authorization entity (AE) adapted to manage identity authentication for a group of automotive devices located in an associated geographical area. The local AE provides, to a first automotive device of the group, an AE identity certificate comprising an encryption key of the local AE and signed with a higher level AE's encryption key. The first automotive device uses the higher level AE's encryption key to decrypt the AE identity certificate and retrieve the local AE's encryption key. The first automotive device uses the local AE's encryption key to verify an identity certificate created by the local AE for a second automotive device of the group. The first automotive device establishes a session with the second automotive device according to an identity posture score extracted from the identity certificate of the second automotive device.

Abstract: A computer-implemented method is provided for screening communication traffic. A list of one or more threshold pairs including respective first and second threshold values, each of which first threshold values is greater than one, are defined. Network traffic from a plurality of sources is monitored, so as to determine for each source a count of unique destination addresses to which the source transmitted data during a period of time. A response to malicious network traffic is invoked responsively to finding that each of a first number of the sources sent data to at least a second number of the destination addresses, wherein, for at least one of the threshold pairs, the first number is at least equal to the respective first threshold value, and the second number is at least equal to the respective second threshold value.