Patent Description:
The present invention, in some embodiments thereof, relates to identifying an abnormal event in an operational environment of a vehicle, and, more specifically, but not exclusively, to identifying an abnormal event in an operational environment of a vehicle based on machine learning analysis of messages transmitted in the vehicle.

The operation of vehicles, specifically ground vehicles such as, for example, cars, trucks, motorcycles, trains and/or the like has long ago become heavily reliant on automated systems utilizing multiple Electronic Control Units (ECU) deployed in the vehicle to control almost every aspect of the operation of the vehicle. This trend is naturally further intensifies with the evolution of autonomic vehicles where the human factor, i.e. the human driver, is no longer the prime controller of the vehicle which is rather controlled by the automated and autonomous systems.

These automated and autonomous systems may include a plurality of devices, for example, ECUs, sensors, Input/Output (I/O) controllers and/or the like communicating with each other to transfer status and/or control data essential for operating the vehicle. These systems may further exchange data with each other thus creating a comprehensive, complex ecosystem within the vehicle.

To support this data exchange, each vehicle may include multiple wired and/or wireless communication channels, for example, Controller Area Network (CAN) bus, Local Interconnect Network (LIN), FlexRay, Local area Network (LAN), Ethernet, automotive Ethernet, Wireless LAN (WLAN, e.g. Wi-Fi), Media Oriented Systems Transport (MOST), Wireless CAN (WCAN) and/or the like to support the data transfer between the deployed devices. The vehicle communication channels are often segmented due to one or more constraints and/or purposes, for example, a requirement for functional segregation, vehicle physical deployment constraints, a hierarchical communication structure and/or the like. Patent document <CIT> discloses an anomaly detector for a Controller Area Network (CAN) bus comprising an electronic data processing device programmed to perform an anomaly alerting method including the operation of performing state space classification on a per message basis of messages on the CAN bus to label each message as either normal or anomalous.

The invention includes a method and a system for identifying an abnormal event in an operational environment of a vehicle. The method comprising, using at least one processor adapted for receiving a plurality of messages intercepted by at least one device adapted to monitor messages transmitted via at least one segment of at least one communication channel, arranging in a time continuum, based on a timing attribute of each of the plurality of messages and according to at least one message arrangement rule, at least one subset of the plurality of messages, where each of the at least one arranged subset of the plurality of messages is defined as a respective unified time ordered dataset, mapping the at least one unified time ordered dataset to a baseline model according to at least one of a plurality of features identified for at least one of the messages of the at least one subset, the plurality of features comprising relating to a timing of the at least one message and to a content of the at least one message, the baseline model which defines a plurality of learned message sequence patterns is created and adjusted by combining a plurality of different machine learning algorithms that are trained and applied independently on a plurality of training datasets comprising a plurality of training unified time ordered datasets reflecting valid operation of the vehicle, where each of the different machine learning algorithms is applied on a respective one of the plurality of training datasets, identifying incompliance of the at least one unified time ordered dataset with the baseline model, the incompliance is indicative of at least one abnormal event in the operation of the vehicle, and generating an alert indicative of the at least one abnormal event, where the at least one message arrangement rule defines at least one of: a time based arrangement and a space based arrangement, the time based arrangement relates to at least one timing attribute of the messages of the at least one subset, the space based arrangement relates to a communication channel segment in where the messages of the at least one subset are intercepted.

According to some embodiments of the present invention, there are provided methods and systems for identifying one or more abnormal events (operational anomalies) during operation of a vehicle, specifically a ground vehicle, for example, a car, a truck, a motorcycle, a train and/or the like. Identifying the abnormal events is done by intercepting a plurality of messages exchanged between devices of the vehicle over one or more communication channels and identifying one or more messages which do not comply with a baseline model defining massage transmission patterns reflecting valid (normal) operation and/or behavior of the vehicle including, for example, operations states and/or transitions between the operation states.

The baseline model is created during a training phase using a plurality of machine learning models, for example, parametric supervised algorithms, non-parametric semi-supervised algorithms, non-parametric unsupervised algorithms and/or the like trained with a plurality of training samples comprising messages sequences reflecting and/or simulating the valid operation of the vehicle. The different types of the machine learning models may be applied independently, simultaneously and/or in sequence to create the baseline model such that the baseline model defining the valid operation of the vehicle is constructed as a flat, a hierarchical, a layered and/or a sequenced model.

The plurality of training samples comprising training messages sequences reflecting and/or simulating the valid operation of the vehicle are selected, created and/or adapted according to each of the types of the machine learning models. The parametric supervised algorithms, for example, may be trained with annotated (labeled) training datasets comprising message sequences having predefined features (parameters) values and labeled with respective labels associating each message with a respective class corresponding to valid operation of the vehicle. The message features may include for example, a message rate, a messages size, a messages payload (content), a sequence of messages, cross-correlation of messages across different network segments, cross-correlation of payload between multiple different messages, cross-correlation of messages over time and/or the like. The non-parametric semi-supervised algorithms may be trained with annotated (labeled) training datasets comprising training message sequences having features which are not predefined. The non-parametric unsupervised algorithms may be trained with unlabeled (unannotated) training datasets and may update the baseline model by clustering the training messages of the training datasets according to characteristics, attributes and/or relations detected and learned for the training messages of the training datasets and/or between them.

Optionally, the machine learning models are trained with training datasets comprising unified time ordered datasets of messages. The unified time ordered datasets are created according to one or more message arrangement rules which may define consolidation of multiple messages to a respective unified time ordered messages dataset. The message arrangement rules define time based arrangement such that the unified time ordered messages dataset are arranged according to a timing of transmission (and interception) of each of the messages thus consolidating groups of the plurality of messages in a time continuum. For example, a certain message arrangement rule may dictate grouping together multiple messages intercepted within a certain time period, for example, five seconds and/or the like. In another example, a certain message arrangement rule may dictate grouping together multiple messages of the same type intercepted at a specific time period, for example, every round hour and/or the like.

The message arrangement rules may further define space based arrangement such that the unified time ordered messages dataset are arranged to include messages according to an interception location, i.e. a communication channel(s) and/or a segment(s) thereof thus consolidating groups of the plurality of messages in a space continuum. The baseline model is therefore adapted to reflect the features of unified time ordered datasets comprising multiple messages. For example, a certain message arrangement rule may dictate grouping together multiple messages intercepted at a certain communication channel, for example, a CAN bus. In another example, a certain message arrangement rule may dictate grouping together multiple messages of the same type intercepted at two communication channels connected through a certain bridge.

The message arrangement rules may also dictate grouping together multiple messages to create unified time ordered datasets based on both time and space attributes. For example, a certain message arrangement rule may dictate grouping together multiple messages intercepted at a certain communication channel segment during a certain time period, for example, <NUM> seconds and/or the like.

In real time, a plurality of messages exchanged between devices and/or systems of the vehicle are intercepted by one or more monitoring devices deployed to monitor one or more of the communication channels of the vehicle and/or segments thereof. The monitoring device(s) may optionally be configured as passive receiver-only device incapable of injecting data to the communication channels. The monitoring device(s) may be coupled to the communication channel(s) in an isolated manner thus incapable of inducing, altering, manipulating and/or otherwise affecting the transmission signals of the communication channels in any way.

Each of the intercepted messages may be mapped (clustered, classified, etc.) to the baseline model created during the training phase to determine compliance of the intercepted message compared to the baseline model. Incompliance of one or more messages with the baseline model is indicative of one or more abnormal events (operational anomalies). Such abnormal events may indicate of one or more potentially malicious devices which transmit non-compliant message(s) in an attempt to disrupt, compromise and/or affect the normal operation of the vehicle. Additionally and/or alternatively, such abnormal events may be indicative of one or more devices and/or systems of the vehicle experiencing (exhibiting) a malfunction(s), failure(s), degraded functionality and/or the like.

In case of detection of the abnormal event(s), i.e. the non-compliant message(s), one or more actions may be initiated, for example, generating an alert to one or more local and/or remote automated systems, generating an indication to a driver, a user, a passenger and/or an operator of the vehicle and/or the like. Optionally, further proactive operations may be taken in response to the abnormal event detection, for example, operate one or more devices and/or systems of the vehicle to prevent, circumvent and/or bypass potentially malicious and/or erroneous control message(s), apply security measures to identify and/or isolate the potentially malicious device(s), deploy emergency and/or maintenance procedures to encounter the malfunction(s) and/or failure(s) and/or the like.

Abnormal event detection using the baseline model created using the machine learning models may present significant advantages and benefits. First, vehicles, in particular ground vehicles are constantly evolving and becoming more automated with the final goal to become completely autonomous. These vehicles may be highly susceptible to malicious operation(s) and/or failure(s) of the vehicle's device(s) and/or system(s) which may inflict major effects to the vehicle, its passenger(s), other vehicles, infrastructure and/or people in the vehicular environment. Such effects may include, for example, accident(s) and/or the like having major consequences ranging from damage through injury(s) to fatalities. It is therefore imperative to identify in real time abnormal events indicative of such malicious operations and/or failures thus significantly reducing and potentially preventing these harsh consequences.

Some existing methods may apply rule based methods and/or systems to detect the abnormal event(s) by comparing transmission of the intercepted messages to predefined rules and identifying incompliance with the rules. Such rule based implementations may require identifying in advance most if not all possible valid, legitimate and/or normal operation modes or states of the vehicle. Such rule based methods may further attempt to predict potential abnormal events and define the respective message transmission rules. The rule based approach may naturally be very limited as it is impossible to predict all operation modes and states as well as abnormal events in advance.

The baseline model on the other hand may automatically and constantly evolve through training using the machine leaning algorithms to adapt to new vehicle operation scenarios. In addition, the baseline model may be updated using large volumes of realistic training datasets thus significantly improving the accuracy and comprehensiveness of the baseline model. Detecting the abnormal events using the baseline model may therefore be significantly more comprehensive, accurate and/or effective compared to the rule based implementations. In addition, adaptation of the rule based methods and/or systems to new operational modes/states and/or abnormal events may require extensive efforts and/or time to design new rules, to verify proper operation of the adjusted system, to re-deploy the adjusted system in the vehicles and/or the like. In contrast, the baseline model deployed in the vehicle automatically evolves in real time and may therefore significantly reduce such efforts and/or time for adjusting, verifying and/or deploying the system.

Furthermore, applying multiple types of machine learning models may significantly enhance accuracy, comprehensiveness and/or efficiency of the created baseline model used for detecting the abnormal events. While each of the classifier types may present some benefits and advantages, they may each suffer some inherent deficiencies. Applying a combination of all types of the machine learning models may therefore result in the baseline model being a highly accurate and comprehensive model which overcomes the limitations and/or deficiencies presented by each type of algorithms individually. For example, the parametric supervised algorithms may define a clear baseline of valid message transmission patterns reflecting the valid operation of the vehicle where each of the message transmission patterns is well defined (expressed) by predefined message features' values and/or patterns for the messages and/or of the unified time ordered datasets.

However, by their nature the parametric supervised algorithms may be limited to the features' values and patterns predefined for the message transmission patterns. To overcome this, the non-parametric semi-supervised algorithms may be applied to expand the valid message transmission patterns defined by the baseline model to include learned values and/or patterns of the features of the messages and/or of the unified time ordered datasets. The Non-parametric unsupervised algorithms may further expand the baseline model to include learned message transmission patterns which are expressed by learned values and/or patterns of the features of the messages and/or of the unified time ordered datasets.

In addition, using the receiver-only monitoring device(s) for intercepting the messages without affecting the transmission signals of the communication channel(s) may significantly reduce the potential for a failed monitoring device(s) to affect and possibly jeopardize the operation of the communication channel(s). Moreover, malicious adversaries may not use a compromised and/or malicious monitoring device(s) to inject potentially malicious and/or harmful messages in the operational system of the vehicle.

As will be appreciated by one skilled in the art, the present invention is embodied as a system, or method. A computer program product is presented for demonstration purposes and is not part of the invention.

Such a propagated signal may take any of a variety of forms, including, but not limited to, electromagnetic, optical, or any suitable combination thereof.

Computer Program code comprising computer readable program instructions embodied on a computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wire line, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

The program code for carrying out operations for aspects of the present invention may be written in any combination of one or more programming languages, including an object oriented programming language such as Java, Smalltalk, C++ or the like and conventional procedural programming languages, such as the "C" programming language or similar programming languages.

The program code can be downloaded to respective computing/processing devices from a computer readable storage medium or to an external computer or external storage device via a network, for example, the Internet, a local area network, a wide area network and/or a wireless network.

Referring now to the drawings, <FIG> illustrates a flowchart of an exemplary process of identifying abnormal events in an operational environment of a vehicle, according to some embodiments of the present invention. A process <NUM> is executed to identify one or more abnormal events during operation of a vehicle, specifically a ground vehicle by applying trained machine learning models to trained to identify one or more messages exchanged over communication channels of the vehicle which do not comply with a baseline model defining messages transmission patterns reflecting valid, legitimate and/or normal operation of the vehicle including, for example, operation states of the vehicle and/or transitions between the states.

The baseline model may be created during a training phase using the plurality of machine learning models, for example, parametric supervised algorithms, non-parametric semi-supervised algorithms, non-parametric algorithms and/or the like. Each of the groups of machine learning models may be trained with training datasets comprising message sequence(s) designed, constructed and/or selected according to the characteristics of the respective machine learning models, specifically the training datasets may be labeled (annotated) or not and may include message features (parameters) which are predefined or not.

In real time, a plurality of messages exchanged between devices and/or systems of the vehicle are intercepted by one or more monitoring devices deployed to monitor one or more communication channels of the vehicle and/or segments thereof.

Each of the plurality of intercepted messages is mapped (e.g. clustered, classified, etc.) to the baseline model created during the training phase to determine compliance of the intercepted message compared to the baseline model. Incompliance of one or more messages with the baseline model is indicative of an abnormal event in which one or more potentially malicious devices transmitted the non-compliant message(s). Additionally and/or alternatively, such non-compliant message(s) may be indicative of an abnormal event in which one or more legitimate devices and/or systems of the vehicle experience (exhibit) one or more malfunctions and/or failures.

In the event of detection of the abnormal event(s), i.e. the non-compliant message(s), one or more actions may be initiated, for example, initiating an abnormal event alert and/or the like, informing one or more local and/or remote systems of the abnormal event and/or the like. optionally, further proactive operations may be taken in response to the abnormal event detection, for example, operate the vehicle to prevent, circumvent and/or bypass potentially malicious and/or erroneous control message(s), apply security measures to identify and/or isolate the potentially malicious device(s), deploy emergency and/or maintenance procedures to encounter the malfunction(s) and/or failure(s) and/or the like.

Reference is also made to <FIG>, which is a schematic illustration of an exemplary system for identifying an abnormal event in an operational environment of a vehicle, according to some embodiments of the present invention. An exemplary system <NUM> may include one or more vehicles <NUM> specifically ground vehicles, for example, a car, a truck, a motorcycle, a train and/or the like.

According to some embodiments of the present invention one or more of the vehicles <NUM> includes a respective analysis device <NUM> adapted to execute a process such as the process <NUM>. However, according to some embodiments of the present invention the process <NUM> is executed by a remote analysis server <NUM> for one or more vehicles <NUM> operatively connected to the analysis server <NUM> via a network <NUM> comprising one or more wired and/or wireless networks, for example, a Radio Frequency (RF) link, a LAN, a WLAN, a Wide Area Network (WAN), a Municipal Area Network (MAN), a cellular network, the internet and/or the like. Optionally, in some embodiments, one or more vehicles <NUM> are not continuously connected to the analysis server <NUM> but rather connect to the analysis server <NUM> occasionally, periodically, on demand and/or the like. For example, a certain vehicle <NUM> may connect to the remote analysis server <NUM> when parked in a certain parking space, for example, at home, at a work place and/or the like. Moreover, the certain vehicle <NUM> may take advantage of networking capabilities and/or infrastructures provided by the parking space, for example, connectivity to the network <NUM>. In such case, the certain vehicle <NUM> may connect to the parking space network infrastructure, for example, a wireless router (e.g. Wi-Fi router) serving as a gateway to provide access to the network <NUM> and through it to the analysis server <NUM>.

The analysis device <NUM> may include a network interface <NUM> to provide connectivity for the vehicle <NUM>, a processor(s) <NUM> for executing a process such as the process <NUM> and storage <NUM> for storing program code (serving as program store program store) and/or data. The network interface <NUM> may include one or more wired and/or wireless network interfaces for connecting to the network <NUM>. The processor(s) <NUM>, homogenous or heterogeneous, may include one or more processing nodes arranged for parallel processing, as clusters and/or as one or more multi core processor(s). The storage <NUM> may include one or more non-transitory memory devices, either persistent non-volatile devices, for example, a hard drive, a solid state drive (SSD), a magnetic disk, a Flash array and/or the like and/or volatile devices, for example, a Random Access Memory (RAM) device, a cache memory and/or the like.

The processor(s) <NUM> may execute one or more software modules, for example, a process, a script, an application, an agent, a utility, a tool and/or the like each comprising a plurality of program instructions stored in a non-transitory medium such as the storage <NUM> and executed by one or more processors such as the processor(s) <NUM>. For example, the processor(s) <NUM> may execute an analyzer module <NUM> for executing the process <NUM> to identify abnormal event(s) in the operational environment of the vehicle <NUM> and take action accordingly.

In case the process <NUM> is executed by the remote analysis server <NUM>, the processor(s) <NUM> may execute a message collector module <NUM> for collecting intercepted messages exchanged over one or more communication channels of the vehicle <NUM>. The message collector <NUM> may further transmit the intercepted messages and/or part thereof to the remote analysis server <NUM> via the network interface <NUM> connected to the network <NUM>.

The analysis server <NUM> may include a network interface <NUM> such as the network interface <NUM> to provide connectivity for the analysis server <NUM>, a processor(s) <NUM> such as the processor(s) <NUM> for executing a process such as the process <NUM> and storage <NUM> for storing program code (serving as program store program store) and/or data. Similarly to the storage <NUM>, the storage <NUM> may include one or more non-transitory memory devices, either persistent non-volatile devices, for example, a hard drive, a solid state drive (SSD), a magnetic disk, a Flash array and/or the like and/or volatile devices, for example, a Random Access Memory (RAM) device, a cache memory and/or the like. The storage <NUM> may further comprise one or more network storage devices, for example, a storage server, a network accessible storage (NAS), a network drive, and/or the like.

The processor(s) <NUM> may execute one or more software modules, for example, a process, a script, an application, an agent, a utility, a tool and/or the like. For example, the processor(s) <NUM> may execute an analyzer module such as the analyzer <NUM> for executing the process <NUM> to identify abnormal event(s) in the operational environment of the vehicle <NUM> and take action accordingly.

Optionally, the analysis system <NUM> and/or the analyzer <NUM> executed by the analysis system <NUM> are provided as one or more cloud computing services, for example, Infrastructure as a Service (IaaS), Platform as a Service (PaaS), Software as a Service (SaaS) and/or the like such as, for example, Amazon Web Service (AWS), Google Cloud, Microsoft Azure and/or the like.

Reference is now made to <FIG>, which is a schematic illustration of an exemplary system for intercepting communication messages exchanged over communication channels of a vehicle, according to some embodiments of the present invention. An exemplary system <NUM> may be deployed in a vehicle such as the vehicle <NUM> for intercepting messages exchanged between a plurality of devices <NUM> deployed in the vehicle <NUM> for collecting data relating to the operation of the vehicle <NUM> and/or for controlling one or more functions and or systems of the vehicle <NUM>. The devices <NUM> may include for example, sensor(s), ECU(s), I/O controller(s), communication controller(s) and/or the like. The topology and deployment of the system <NUM> is exemplary and should not be construed as limiting since multiple other deployments, topologies and/or layouts may be implemented as known in the art.

The sensors may include one or more sensors, for example, an engine operation sensor, an environmental condition sensor (e.g. temperature sensor, a light sensor, a humidity sensor, etc.), a navigation sensor (e.g. a Global Positioning System (GPS) sensor, an accelerometer, a gyroscope, etc.), an imaging sensor (e.g. a camera, a night vision camera, a thermal camera, etc.) and/or the like. The ECUs may include one or more processing units and/or controllers adapted to operated, control and/or execute one or more functions of the vehicle <NUM>, for example, steering, accelerating, breaking, parking, information collection, safety system control, multimedia system control, door control, window control and/or the like. The I/O controllers may include one or more controllers adapted to connect to one or more of the sensors, the ECUs and/or the like. The I/O controllers may include one or more controllers adapted to operate one or more user interfaces, for example, a pointing device, a keyboard, a display, an audio interface and/or the like. The communication controllers may include one or more controllers adapted to connect to the network <NUM>. Optionally, one or more of the devices <NUM> may be integrated devices comprising one or more of the sensors, the ECUs, the I/O controllers, the communication controllers and/or the like.

The devices <NUM> may communicate with each other by sending messages over one or more wired and/or wireless (vehicle) communication channels <NUM> deployed in the vehicle <NUM>, for example, CAN bus, LIN, FlexRay, LAN, Ethernet, automotive Ethernet, WLAN (e.g. Wi-Fi), WCAN, MOST and/or the like. The topology of the system may vary and may include a plurality of communication channels <NUM> of various types and various topologies (e.g. bus, point-to-point, multi-drop, etc.) which may be further segmented. By deploying specific types of communication channels <NUM> and optionally segmenting one or more of them, the topology of the system <NUM> may be adapted to accommodate one or more needs, constraints and/or objectives of the system <NUM>, for example, apply segregated domain(s) for sensitive devices <NUM>, adapt to deployment physical limitation(s) of the vehicle <NUM> (e.g. limited space, long distances, etc.), create a hierarchical structure(s) for at least some of the devices <NUM> and/or the like.

For example, one or more devices <NUM>, for example, a device <NUM> N1, a device <NUM> N2 through device <NUM> Nn may connect to a communication channel 302N, for example, a LIN. In another example, one or more devices <NUM>, for example, a device <NUM> M1, a device <NUM> M2 through device Mm may connect to a segmented communication channel <NUM>, for example, a CAN bus comprising two CAN bus segments 302M1 and 302M2. In another example, one or more devices <NUM>, for example, a device <NUM> L1, a device <NUM> L2 through device <NUM> L1 may connect to a communication channel <NUM>, for example, a MOST. In another example, one or more devices <NUM>, for example, a device <NUM> J1, a device <NUM> J2 through a device <NUM> Jj may connect to a communication channel 302J, for example, a Wi-Fi network.

The system <NUM> may further include one or more bridges <NUM> adapted to connect between communication channels <NUM> of different types and/or between segments of one or more of the communication channels <NUM>. The bridges <NUM> may transfer one or more messages from one communication channel <NUM> to another communication channels <NUM> in one or both directions to allow propagation of messages between the communication channels <NUM>. Naturally, each bridge <NUM> includes the appropriate interfaces and/or ports for connecting to the respective communication channels <NUM> it connects to. For example, a bridge <NUM>-N may connect the communication channel 302N and the communication channel <NUM>. In another example, a bridge <NUM> MN-J may connect the communication channels 302N and <NUM> with the communication channels 302J. In another example, a bridge <NUM> may connect between the segments 302M1 and 302M2 of the communication channels <NUM>.

One or more of the devices <NUM> may also serve as a bridge <NUM>. For example, the device <NUM> may bridge between the communication channel <NUM>, specifically the segment 302M2 of the communication channel <NUM> and the communication channel <NUM>. In another example, the device <NUM> J2 may serve as a bridge <NUM> for connecting a device <NUM> J1, a device <NUM> J2 and/or a device <NUM> J3 to the communication channel 302J where the device <NUM> J1 connects to the device <NUM> J2 through a communication channel 302J1, the device <NUM> J2 connects to the device <NUM> J2 through a communication channel 302J2 and the device <NUM> J3 connects to the device <NUM> J2 through a communication channel 302J3. The communication channels 302J1, 302J2 and/or 302J2 may be of the same type and/or of different types.

The system <NUM> may further include one or more monitoring devices <NUM> for monitoring and intercepting communication, specifically messages exchanged between the devices <NUM> over the communication channels <NUM>. The system <NUM> may include a central monitor <NUM> which may connect to a plurality of the communication channels <NUM>. However, the system <NUM> may include a plurality of monitors <NUM>, for example, a monitor <NUM><NUM> which monitors the communication channel 302N, a monitor <NUM><NUM> which monitors the communication channel <NUM> specifically the segments 302M1 and 302M2, a monitor <NUM><NUM> which monitors the communication channel <NUM>, a monitor <NUM><NUM> which monitors the communication channel 302J and/or the like. The monitor <NUM><NUM> may further monitor one or more of the communication channels 302J1, 302J2 and/or 302J3. One or more of the monitors <NUM> may be integrated in one or more of the devices <NUM> and/or the bridges <NUM> such that in addition to its normal operation the integrated device <NUM> or the integrated bridge <NUM> may monitor and intercept messages transmitted on the respective communication channel(s) <NUM> it connects to. According to some embodiments of the present invention, the monitors <NUM> are receive-only devices which are only capable of intercepting (receiving) the messages transmitted on the communication channel(s) <NUM> while unable to transmit messages or affect the communication channel(s) <NUM> in any way.

The monitoring device(s) <NUM> adapted to intercept the messages exchanged over the communication channels <NUM> may optionally be configured as passive receiver-only device incapable of injecting data to the communication channels <NUM>. Furthermore the monitoring device(s) <NUM> may be coupled to the communication channels <NUM> in an isolated manner thus incapable of inducing, altering, manipulating and/or otherwise affecting the transmission signals of the communication channels <NUM> in any way. For example, one or more of the monitoring devices <NUM> may include one or more sensing wires wrapped around one or more insulated wires of one or more of the communication channels <NUM> such that the sensing wire(s) are incapable of injecting data, messages and/or signals to the communication channel(s) <NUM>. By analyzing the electric load, current and/or voltage of the signals travelling (propagating) through the insulated wires of the communication channel(s) <NUM> as sensed by the sensing wire(s), the monitoring device(s) <NUM> may detect messages exchanged over the communication channel(s) <NUM> and intercept them. In another example, one or more of the monitoring devices <NUM> may include a wireless receiver-only capable of intercepting wireless messages exchanged between one or more of the devices <NUM> while incapable of transmitting messages.

In order to be able to correlate the intercepted messages with time and/or space attributes, the monitoring device(s) <NUM> may assign metadata to one or more of the intercepted messages which may be naturally be intercepted at different communication channels <NUM> at different times. The metadata assigned to the intercepted message(s) may include, for example, a time tag indicating a time of interception of the respective message, a source communication channel <NUM> where the respective message is intercepted and/or the like. The metadata assigned to the intercepted messages may be used to correlate messages intercepted at various times and/or locations (communication channels <NUM>) to create one or more time continuum and/or space continuum meta-events. The meta-event(s) may be arranged as one or more unified time ordered datasets reflecting typical patterns and behavior of communication traffic (message transmission) over the communications channel(s) <NUM> of the vehicle <NUM>.

The intercepted messages may be transferred (exported) to the analysis server <NUM> and/or to the analysis device <NUM> for analysis.

One or more of the devices <NUM> may be adapted to control a network interface such as the network interface <NUM> for connecting to a network such as the network <NUM> to transmit the intercepted messages to the analysis server <NUM>.

The system <NUM> may further include an analysis device such as the analysis device <NUM> which may receive the intercepted messages from the monitor(s) <NUM>.

Optionally, one or more mechanisms are applied to reduce the volume of the exported message data transferred to the to the analysis server <NUM> and/or to the analysis device <NUM> thus reducing the networking bandwidth required for the transfer. Reducing the bandwidth may be essential due to one or more limitations, for example, limited network resources (bandwidth, latency, etc.), limited computing resources, limited storage resources and/or the like. For example, a single low speed CAN bus running at <NUM> Kb/s, utilized on average to <NUM> Kb/s may generate <NUM> KB of messages data per second. As such the message data for the single CAN bus per day (<NUM> hours) may amount to about <NUM> MB.

The mechanisms applied to reduce the message data include, for example:.

The message data volume reduction mechanisms may be applied by one or more components of the system <NUM>, for example, the monitoring device(s) <NUM>, the analysis device(s) <NUM>, the bridge(s) <NUM> and/or the like. For example, a certain monitoring device <NUM> may be configured to apply one or more of the filtering rules dictating discarding a status message which is periodically transmitted by one or more of the devices <NUM>. In another example, a certain bridge <NUM> adapted to transmit the intercepted messages to the analysis server <NUM> via the network <NUM> may compress the message ID, the payload and/or the metadata of one or more of the intercepted messages before transmitting them to analysis server <NUM>.

Reference is made once again to <FIG> and <FIG>.

As shown at <NUM>, the process <NUM> starts with a training phase in which the message analyzer <NUM> applies a plurality of machine learning models to create a baseline model defining message transmission patterns reflecting the valid operation of the vehicle <NUM>. The baseline model defines one or more message transmission patterns reflecting valid operation and/or behavior of the vehicle <NUM>, for example, a finite range of valid, legitimate and/or normal operation states of the vehicle <NUM>, for example, driving, braking, turning, parking, stopping at a traffic light, following a navigation path, controlling door open/close and/or the like. The baseline model may further define one or more message transmission patterns reflecting legal (valid) transitions between the operation states. Each of the transmission patterns may be defined by one or more of a plurality of features of the messages and/or of message groups, for example, a message rate (frequency), a sequence of messages, an N-gram (predefined sequence), a message size, a message payload entropy, a value distribution in data bytes of the message payload, a cross-correlation between messages intercepted at different segments of the communication channels <NUM>, a cross-correlation of payload between multiple different messages, a cross-correlation of payload between messages over time and/or the like.

The plurality of machine learning models applied by the message analyzer <NUM> may include a mixture of parametric & non-parametric, supervised, unsupervised and semi-supervised machine learning algorithms to create the baseline model which defines a baseline characterizing the message transmission patterns which are valid for the vehicle <NUM>. The machine learning models may include one or more machine learning probabilistic models, engines and/or algorithms, for example, a neural network, a support vector machine (SVM), a decision tree, a K-Nearest neighbors algorithm, a context tree, a graphical model, a Bayesian net, a random forest, a rotational forest, a deep learning algorithm and/or any other learning algorithm trained as known in the art. The machine learning models may further include spectral clustering, hashing, boosting and/or the like.

The message analyzer <NUM> may apply the different types of the machine learning models independently, simultaneously and/or in sequence to create the baseline model such that the baseline model defining the valid message transmission patterns of the vehicle <NUM> is constructed as a flat, a hierarchical, a layered and/or a sequenced model.

The machine learning models are trained with a plurality of training datasets designed, constructed and/or selected according to the type of the algorithms, i.e. parametric vs. non-parametric, supervised, unsupervised and/or semi-supervised. The training datasets include messages reflecting typical patterns and behavior of communication traffic (message transmission) over the communications channel(s) <NUM> of the vehicle <NUM>. The training datasets may include stationary data, nonstationary data, descriptive statistics, higher moments, information content and/or the like.

The training datasets may be further designed, adapted, adjusted, constructed and/or selected based on statistical analysis of the message features in real transmission during valid operation of the vehicle <NUM>. Such statistical analysis may be done using one or more Statistical Process Control (SPC) techniques as known in the art, for example, dependent and/or independent random variables, Cumulative Sum (CUSUM), Exponentially Weighted Moving Average (EWMA), Hotelling's T<NUM>, Bayesian SPC, likelihood scoring, time series modeling and/or the like.

Optionally, the message analyzer <NUM> applies dimension reduction to the training datasets to reduce one or more dimensions of the message features defining the messages in the training datasets in order to reduce computing resources such as, for example, computing power, computing time, storage space and/or the like. The message analyzer <NUM> may apply one or more dimension reduction methods, techniques and/or algorithms as known in the art, for example, feature selection, Principal Component Analysis (PCA), logistic-PCA, Singular Value Decomposition (SVD), t-distributed Stochastic Neighborhood Embedding (t-SNE), clustering and/or the like.

Optionally, the message analyzer <NUM> trains the machine learning models with training datasets comprising unified time ordered datasets of messages created according to one or more message arrangement rules which may define consolidation of multiple messages to a respective unified time ordered messages datasets. The consolidation may be based on the metadata of the messages which as described herein before may include, for example, the time tag indicating the time of interception of the respective message, the source communication channel <NUM> where the respective message was intercepted and/or the like. The message arrangement rules may define time based arrangement such that the unified time ordered messages dataset are arranged according to a timing of transmission (and interception) of each of the messages thus consolidating groups of the plurality of messages in a time continuum. For example, a certain message arrangement rule may dictate grouping together multiple messages intercepted within a certain time period, for example, five seconds and/or the like. In another example, a certain message arrangement rule may dictate grouping together multiple messages of the same type intercepted at a specific time period, for example, every round hour and/or the like.

The message arrangement rules may further define space based arrangement such that the unified time ordered messages dataset are arranged to include messages according to an interception location, i.e. a communication channel(s) <NUM> and/or a segment(s) thereof to consolidate groups of the plurality of messages in a space continuum. For example, a certain message arrangement rule may dictate grouping together multiple messages intercepted at a certain communication channel <NUM>, for example, a CAN bus. In another example, a certain message may propagate from one communication channel <NUM> to another communication channel <NUM>. A certain message arrangement rule may therefore dictate grouping together multiple messages of the same type intercepted at two communication channels <NUM> connected through a certain bridge.

The message arrangement rules may also dictate grouping together multiple messages to create unified time ordered datasets based on both time and space attributes. For example, a certain message arrangement rule may dictate grouping together multiple messages intercepted at a certain communication channel <NUM> within a certain time period, for example, <NUM> seconds and/or the like. Based on the arrangement rules, a respective unified time ordered dataset may therefore include one or more messages having one or more instances two each intercepted at a different location (channel/segment) at a different time assigned and having a respective time tag and a respective interception location (channel/segment) tag. The trained machine learning models may thus correlate between the two instances of the certain message and identify it as a pattern reflecting valid operation of the vehicle <NUM>.

The message arrangement rules may be based on one or more message attributes, for example, an originating device such as the device <NUM>, a destination device <NUM>, a message type, a message identifier, a message size, a message (payload) content, a message timing, a type of communication channel <NUM>, an identifier of the communication channel <NUM>, an identifier of the segment and/or the like.

The parametric supervised algorithms may be trained with a plurality of annotated training datasets each labeled with a class label associated with a valid message transmission pattern reflecting valid operation of the vehicle <NUM>, for example, a respective one of the plurality of legitimate operation states of the vehicle <NUM> such as, for example, driving, braking, turning, parking, stopping at a traffic light, following a navigation path, controlling door open/close and/or the like. Moreover, one or more class labels may be associated with valid message transmission pattern reflecting valid transitions between the operation states of the vehicle <NUM>. The annotated training datasets further include predefined values and/or patterns for the messages' features. In order to create an accurate and comprehensive baseline model capable of accurately defining real operation of the vehicle <NUM>, the parametric supervised algorithms trained to create the baseline model may be trained with a large number of training datasets. Each of the training datasets may be selected, adjusted, configured, designed and/or constructed to include multiple features with various values to define a plurality message transmission patterns reflecting valid operation of the vehicle <NUM>. The predefined features and values may evolve with time as the parametric supervised algorithms may be trained with new training datasets and/or with real datasets comprising data extracted from the intercepted messages exchanged on the communications channels <NUM> of the vehicle <NUM>. The features defined for the training datasets may include, for example:.

As described herein before, the training datasets may be adapted to reflect the time and space continuum for the intercepted messages as well as for the unified time ordered datasets of messages. For example, a certain message may traverse (propagate) multiple communication channels <NUM> and/or segments thereof as it is being forwarded and/or relayed between the communication channels <NUM> and/or the segments. As such a certain message may be intercepted multiple times at multiple locations (channel/segment). For example, the certain message may be intercepted at a first communication channel <NUM>, for example, the communication channel 302A at time t = <NUM> seconds and at a second communication channel <NUM>, for example, the communication channel 302B at time t = <NUM> seconds. These two intercepted messages may naturally correlate with each other.

During the training phase the parametric supervised algorithms may adjust their weights to accurately cluster and classify each of the training datasets to match the labels assigned to each training dataset.

The non-parametric semi-supervised algorithms may be trained with a plurality of annotated training datasets each labeled with a class label indicating a respective one of the plurality of valid message transmission patterns. However, in contrast to the training datasets used to train the parametric supervised algorithms, these training datasets do not include predefined values and/or patterns for the messages' features. The values and/or patterns of the features of the messages and/or of the unified time ordered datasets are rather learned by the non-parametric semi-supervised algorithms based on analysis of the training datasets. The non-parametric semi-supervised algorithms may identify relations, correlations and/or patterns of the messages included in the training datasets and adjust their weights accordingly to accurately cluster and classify each of the training datasets to match the labels assigned to each training dataset.

By applying the non-parametric semi-supervised algorithms to adjust the baseline model, the valid message transmission patterns may be expressed through values and/or patterns of the features which are not predefined in advance and are therefore not limited as may be the case for the parametric supervised algorithms. Rather the non-parametric semi-supervised may evolve and learn features sets corresponding, correlating and/or indicative of respective valid message transmission patterns reflecting valid operation of the vehicle <NUM>.

The non-parametric unsupervised algorithms may be trained with a plurality of training datasets which are not annotated and do not include predefined values and/or patterns for the messages' features. In this case, the non-parametric unsupervised algorithms may cluster the training datasets to clusters according to the values and/or patterns identified for the messages' features based on analysis of the training datasets. The non-parametric unsupervised algorithms may identify relations, correlations and/or patterns of the messages' features included in the training datasets and adjust their weights accordingly to cluster and classify each of the training datasets to respective clusters presenting similar values and/or patterns for the messages' features.

By applying the non-parametric unsupervised algorithms to adjust the baseline model, the baseline model may be expanded and enhanced to include valid message transmission patterns which are not predefined in advance and are therefore not limited to predefined message transmission patterns as may be the case for both the parametric supervised algorithms and/or the non-parametric semi-supervised algorithms. Rather the non-parametric unsupervised creates and identifies clusters which comprise messages and/ unified time ordered datasets of messages which share similarity (within a certain deviation, i.e. threshold) of the values and/patterns identified for the messages' features in the training datasets.

While each of the types of algorithms may present benefits and advantages, they may each suffer some inherent deficiencies. Therefore by applying a combination of all types of algorithms, specifically the parametric supervised algorithms, the non-parametric semi-supervised and the non-parametric unsupervised, the message analyzer <NUM> may create the baseline model to be an accurate and comprehensive model which overcomes the limitations presented by each type of algorithms. The parametric supervised algorithms may define a clear baseline of the valid, legitimate and/or allowed message transmission patterns expressed by the predefined values and/or features of the messages and/or of the unified time ordered datasets which in turn reflect valid operation and/or behavior of the vehicle <NUM>. The non-parametric semi-supervised algorithms may expand the baseline model to include predefined message transmission patterns which are defined (expressed) by the learned values and/or features of the messages and/or of the unified time ordered datasets. The Non-parametric unsupervised algorithms may further expand the baseline model to include message transmission patterns which are not predefined and are expressed by the learned values and/or features of the messages and/or of the unified time ordered datasets.

According to some embodiments of the present invention, the message analyzer <NUM> may apply the machine learning models in a phased (sequenced) processing pipeline to create the baseline model. The message analyzer <NUM> may break down the intercepted messages to multiple processing stages thus creating a pipelined representation of the baseline model defining valid message transmission patterns reflecting valid operation and behavior of the vehicle <NUM>.

Reference is now made to <FIG>, which is a flowchart of an exemplary phased processing pipeline process for creating a baseline model, according to some embodiments of the present invention. An exemplary process <NUM> may be executed by a message analyzer such as the message analyzer <NUM> training the plurality of machine learning models in the phased processing pipeline to create the baseline model. The exemplary process <NUM> presents a sequenced construction of the baseline model in which the message analyzer <NUM> applies two sets of machine learning models in sequence. However, the exemplary implementation described by the process <NUM> should not be construed as limiting since the machine learning models are applied independently, simultaneously and/or in sequence in a plurality of manners, sequences and/or hierarchies.

As shown at <NUM>, the process <NUM> starts with the message analyzer <NUM> receiving a plurality of training samples comprising messages and/or unified time ordered datasets reflecting typical, valid and/or legal patterns and/or behavior of communication traffic (message transmissions) over one or more communications channel(s) such as the communications channel(s) <NUM> and/or segments thereof of a vehicle such as the vehicle <NUM>.

As shown at <NUM>, the message analyzer <NUM> applies a first set of machine learning models, for example, the non-parametric unsupervised algorithms to the training datasets to automatically identify and group together messages in respective clusters of the baseline model. The first set of machine learning models may cluster the messages according to the message features, for example, the message types which are correlated, i.e. interacting, indicative, associated and/or the like such that a change in one message may cause a change in one or more other correlated messages of the group.

Reference is now made to <FIG>, which is a schematic illustration of exemplary message clusters created by applying machine learning models to messages intercepted in a vehicular environment, according to some embodiments of the present invention. A message analyzer such as the message analyzer <NUM> applying the first set of machine learning models may create a plurality of clusters <NUM> each comprising a plurality of correlated messages or message types <NUM>. For example, a cluster 510_1 may include messages and/or message types <NUM><NUM>, <NUM><NUM>, <NUM><NUM> and <NUM><NUM>. In another example, a cluster 510_2 may include messages and/or message types <NUM><NUM>, <NUM><NUM>, <NUM><NUM>, <NUM><NUM> and <NUM><NUM>. In another example, a cluster 510_3 may include messages and/or message types <NUM><NUM>, <NUM><NUM>, <NUM><NUM>, <NUM><NUM>, <NUM><NUM>, <NUM><NUM>, <NUM><NUM>, <NUM><NUM>, <NUM><NUM>, <NUM><NUM> and <NUM><NUM>. In another example, a cluster 510_4 may include messages and/or message types <NUM><NUM>, <NUM><NUM>, <NUM><NUM>, <NUM><NUM>, <NUM><NUM> and <NUM><NUM>. In another example, a cluster 510_5 may include messages and/or message types <NUM><NUM>, <NUM><NUM>, <NUM><NUM>, <NUM><NUM>, <NUM><NUM>, <NUM><NUM> and <NUM><NUM>. As seen some messages and/or message types, for example, <NUM><NUM><NUM><NUM> and <NUM><NUM> are not clustered to any of the clusters <NUM> as they do not present any correlation with other messages and/or message types <NUM>.

Reference is now made to <FIG> is a graph chart of an exemplary <NUM> dimensional space distribution of messages clusters created by applying machine learning models to messages intercepted in a vehicular environment, according to some embodiments of the present invention. As seen, when casting an exemplary message type on a <NUM> dimensional plane as may be done by the first set of machine learning models, different clusters, for example, a cluster 510_6, a cluster 510_7, a cluster 510_8 and a cluster 510_9 may be grouped to well defined groups of messages according to their payload feature values.

Reference is also made to <FIG>, which presents graph charts mapping payload bit values for messages classified to different clusters by machine learning models machine learning models, according to some embodiments of the present invention. The graph chart presents an average bit values for the payloads of the messages in each of the clusters 510_6, 510_7, 510_8 and 510_9 where a value "<NUM>" indicates that all payloads in the respective cluster have the value "<NUM>" for the perspective bit, and vice versa, a value "<NUM>" indicates that all payloads in the respective cluster have the value "<NUM>" for the perspective bit. A value of "<NUM>" indicates a bit that is practically random within the respective cluster. As evident from the charts, each of the clusters 510_6, 510_7, 510_8 and 510_9 has a distinct set of values, and further, each pair of the clusters 510_6, 510_7, 510_8 and 510_9 may be a mirror image of another one of the clusters 510_6, 510_7, 510_8 and 510_9.

As shown at <NUM>, after establishing the clusters according to the identified correlation links, the message analyzer <NUM> may apply a second set of machine learning models, for example, the parametric supervised algorithms to the training datasets to break down the various relevant message types to controllable and non-controllable messages where controllable messages refers to messages presenting a limited number of legitimate feature(s) values compared to uncontrollable messages which may presenting any random value for one or more of the features. Based on the identified controllable and non-controllable messages, the message analyzer <NUM> may update the baseline model to reflect possible legitimate message transmission patterns corresponding to valid (legitimate) operation of the vehicle <NUM>, for example, valid operation states of the vehicle <NUM> and optionally allowable transitions between the states. The message analyzer <NUM> may update the baseline model to reflect an expected message transmission pattern for each of these messages independently (for each message type separately) as well as expected dependency (correlation) patterns between messages, i.e. the clusters of interacting messages.

As shown at <NUM>, the message analyzer <NUM> may apply temporal scaling to the baseline model by applying additional metadata comprising condition variables which may apply further constraints to the baseline model in order to adapt the baseline model to various operational conditions as indicated by the metadata variables. For example, the metadata variables may define one or more environment condition attributes such as, for example, day/night, rain, wind, ice on road, high/low temperature and/or the like. By applying the environment condition attribute(s), the baseline model may adapt to specific environmental and/or weather conditions by correlating certain message feature(s) values and/or message transmission patterns with the respective environmental and/or weather conditions. In another example, the metadata variables may define one or more geographical location attributes received for example, from a GPS sensor and/or a GPS system. The geographical location attributes may include for example, urban area, countryside, highway, dirt road, mountain area and/or the like. By applying the geographical location attribute(s), the baseline model may adapt to specific geographical location conditions by correlating certain message feature(s) values and/or message transmission patterns with the respective geographical location conditions.

Reference is now made to <FIG>, which is a schematic illustration of an exemplary state machine describing state transition between messages clusters identified by applying machine learning models to messages intercepted in a vehicular environment, according to some embodiments of the present invention. A state machine <NUM> which may be a segment of the baseline model presents an exemplary state transition probability distribution for transitions between clusters of messages identified by a set of machine learning models, for example, the first set of machine learning models. The state machine <NUM> may be created by the message analyzer <NUM> applying the temporal scaling to clusters such as the clusters 510_6, 510_7, 510_8 and 510_9. As seen from the state machine <NUM> transitions are identified during the training phase between some of the clusters <NUM>, for example, a transition from the cluster 510_6 to the cluster 510_8, a transition from the cluster 510_6 to the cluster 510_9, a transition from the cluster 510_8 to the cluster 510_6, a transition from the cluster 510_8 to the cluster 510_6 and more. Moreover, a probability score may be calculated and assigned to each such transition to indicate a probability of the respective transition to actually occur. Some transition however, are not identified during the training phase, for example, there is no transition from the cluster 510_6 to the cluster 510_7 and vice versa, there is no transition from the cluster 510_8 to the cluster 510_9 and vice versa and so on. This may indicate that two consecutive messages may not belong to such unconnected clusters <NUM>. For example, assuming a first message which is clustered to the cluster 510_6 is followed by a second message, the second message may not belong to the cluster 510_7. However, the second message may belong to the cluster 510_8 or the cluster 510_9 with the respective probabilities as indicated by the state machine <NUM>.

The steps <NUM>, <NUM>, <NUM> and <NUM> of the process <NUM> are conducted by the message analyzer <NUM> in real time after creating the baseline model during the training phase described in step <NUM>.

As shown at <NUM>, the message analyzer <NUM> receives a plurality of messages intercepted at one or more of the communication channels <NUM> and/or segments thereof. As described herein above, the message analyzer <NUM> may be locally executed by the analysis device <NUM> which is connected to one or more of the communication channels <NUM> as described for the system <NUM>. In such case, the message analyzer <NUM> may receive the intercepted messages from one or more monitors such as the monitor <NUM> adapted to monitor the communication channel(s) <NUM> and intercept transmitted messages. In case the message analyzer <NUM> is remotely executed by the analysis server <NUM>, the message analyzer <NUM> may receive the intercepted messages from the message collector <NUM> which may collect the intercepted messages from the monitor(s) <NUM> and forward them to the analysis server <NUM> via the network <NUM>.

Optionally, multiple messages may be grouped together according to the message arrangement rule(s) to create one or more unified time ordered datasets comprising multiple messages.

As shown at <NUM>, the message analyzer <NUM> attempts to map, i.e. cluster, classify and/or the like each of the intercepted messages to the baseline model. The message analyzer <NUM> may analyze each intercepted message to identify one or more features of the message and their respective value(s) and map the message to the baseline model according to the detected feature(s) and their value(s). The mapping process (e.g. clustering, classification, etc.) may be very similar to the process described for the training phase with the exception that the intercepted messages are naturally not labeled.

Optionally, in case one or more unified time ordered datasets are available, i.e. received, the message analyzer <NUM> attempts to map (e.g. cluster, classify, etc.) each of the unified time ordered datasets to the baseline model according to the correlation between messages of the unified time ordered dataset and/or according to one or more features, characteristics and/or attributes of the messages included in the unified time ordered dataset.

As shown at <NUM>, the message analyzer <NUM> may identify one or more messages and/or unified time ordered datasets which are incompliant with the baseline model, i.e. the incompliant message(s) may not be mapped (e.g. clustered, classified, etc.) to any of the message transmission patterns defined by the baseline model which reflect the valid operation of the vehicle <NUM>. The inability of the message analyzer <NUM> to map the incompliant message into the baseline model may be indicative that the transmission of the incompliant message is not defined be the valid message transmission patterns and may rather result from one or more abnormal events which occurred in the operational environment of the vehicle <NUM>. Such abnormal events may be indicative of one or more malicious devices present in the operational environment of the vehicle <NUM> executed by a system such as the system <NUM> of the vehicle <NUM>. Additionally and/or alternatively, the abnormal event may be indicative of one or more malfunctions and/or failures of one or more of the devices <NUM> which transmitted the incompliant message(s) due to a failure in their normal operation mode(s).

For example, assuming that according to the baseline model, a message indicating a speed change received, for example, from a speed sensor is preceded by a message indicating a change in position of the acceleration throttle received, for example, from a throttle position sensor. Such message transmission pattern may typically be used for training the machine learning models and is hence reflected in the baseline model. In case a speed change message intercepted in real time in the operational environment of the vehicle <NUM> is not preceded by such a throttle position change message, the message analyzer <NUM> may be unable to classify the speed change message since it is incompliant with the baseline model. The message analyzer <NUM> may therefore determine that such an incompliant message resulted from one or more abnormal events taking place in the operational environment of the vehicle <NUM>. The abnormal event reflected by the transmission of the incompliant message may result from a failure or malfunction of one or more of the devices <NUM>, for example, a throttle position sensor and/or the like. Additionally and/or alternatively, the abnormal event reflected by the transmission of the incompliant message may be indicative of a malicious party using a malicious device (deployed in the system <NUM> of the vehicle <NUM>) to transmit a malicious message for one or more malicious objectives, for example, hijack the vehicle <NUM>, cause an accident and/or the like.

In another example, some types of messages are periodically received from their respective sensors and/or devices, for example, throttle messages indicating a current position of the acceleration throttle and speed messages indicating a current speed of the vehicle <NUM>. Further assuming an increase in a payload value of the throttle message indicates an increase in the position of the throttle, i.e. acceleration command and vice versa. Assuming that the baseline model defines that a speed increase reflected by an increase in the payload value of the throttle messages is correlated with a speed increase reflected by an increase in the payload value of the speed messages. In case the payload values of the speed messages and the throttle messages intercepted in real time in the operational environment of the vehicle <NUM> within a predefined time interval (e.g. <NUM>) are inconsistent with each other, the message analyzer <NUM> may be unable to classify this message sequence (transmission pattern) in the baseline model and may therefore determine the message sequence is incompliant with the baseline model. The message analyzer <NUM> may therefore determine that such incompliant message sequence (pattern) resulted from one or more abnormal events taking place in the operational environment of the vehicle <NUM>.

In another example, assuming that according to the baseline model, a message indicating of acceleration (i.e. speed increase) is preceded by a message indicating a change of traffic light from red to green received for, example, from a device <NUM> analyzing image(s) captured by an imaging sensor depicting the traffic light. Such a sequence of messages (message transmission pattern) may be thus reflected in the baseline model. In case an acceleration message intercepted in real time in the operational environment of the vehicle <NUM> is not preceded by such a traffic light change message, the message analyzer <NUM> may be unable to classify the detected acceleration message since it is incompliant with the respective message transmission pattern defined by the baseline model. The message analyzer <NUM> may therefore determine that such an incompliant message resulted from one or more abnormal events taking place in the operational environment of the vehicle <NUM>.

The above examples are simplistic illustrated to present the concept of the analysis of message features to identify message(s) which are incompliant with the baseline model. Naturally the baseline model may be created and trained to map far more complex transmission patterns of messages and/or unified time ordered subsets.

As shown at <NUM>, upon detection of the abnormal event(s), the message analyzer <NUM> may initiate one or more actions accordingly to contain and/or inform of the abnormal event(s). For example, the message analyzer <NUM> may initiate an abnormal event alert to one or more parties, for example, a driver of the vehicle <NUM>, a security service associated with the vehicle <NUM>, an emergency service and/or the like. In another example, the message analyzer <NUM> may operate the vehicle to prevent, circumvent and/or bypass potentially malicious and/or erroneous control message(s) to prevent the incompliant message from affecting the normal operation of the vehicle <NUM>. In another example, the message analyzer <NUM> may apply one or more security measures to identify and/or isolate the potentially malicious device(s). In another example, the message analyzer <NUM> may deploy emergency and/or maintenance procedures to encounter one or more failures and/or malfunctions estimated based on analysis of the incompliant message(s).

It is expected that during the life of a patent maturing from this application many relevant systems, methods and computer programs will be developed and the scope of the terms machine learning algorithms and/or vehicle communication channels are intended to include all such new technologies a priori.

It should be understood that the description in range format is merely for convenience and brevity.

Claim 1:
A computer implemented method of identifying an abnormal event in an operational environment of a vehicle (<NUM>), comprising:
using at least one processor (<NUM> and/or <NUM>) adapted for:
receiving a plurality of messages intercepted by at least one device (<NUM>) adapted to monitor messages transmitted via at least one segment of at least one communication channel (<NUM>) of a vehicle (<NUM>);
arranging in a time continuum, based on a timing attribute of each of the plurality of messages and according to at least one message arrangement rule, at least one subset of the plurality of messages, wherein each of the at least one arranged subset of the plurality of messages is defined as a respective unified time ordered dataset;
mapping the at least one unified time ordered dataset to a baseline model according to at least one of a plurality of features identified for at least one of the messages of the at least one subset, the plurality of features comprising relating to a timing of the at least one message and to a content of the at least one message, the baseline model which defines a plurality of learned message sequence patterns is created and adjusted by combining a plurality of different machine learning algorithms that are trained and applied independently on a plurality of training datasets comprising a plurality of training unified time ordered datasets reflecting valid operation of the vehicle (<NUM>), wherein each of said different machine learning algorithms is applied on a respective one of the plurality of training datasets;
identifying incompliance of the at least one unified time ordered dataset with the baseline model, the incompliance is indicative of at least one abnormal event in the operation of the vehicle (<NUM>); and
generating an alert indicative of the at least one abnormal event;
wherein the at least one message arrangement rule defines at least one of: a time based arrangement and a space based arrangement, the time based arrangement relates to at least one timing attribute of the messages of the at least one subset, the space based arrangement relates to a communication channel segment in where the messages of the at least one subset are intercepted.