Patent Document ID: 10083071
Application ID: 14857098
Patent Flag: 1

Claim One:
1. An anomaly detector for a Controller Area Network (CAN) bus, the anomaly detector comprising an electronic data processing device programmed to perform an anomaly alerting method including the operations of: performing state space classification on a per-message basis of messages on the CAN bus to label each message as either normal or anomalous wherein the state space classification employs a classifier; performing temporal pattern analysis of messages on the CAN bus as a function of time to label unexpected temporal patterns as anomalous wherein the temporal pattern analysis includes the operations of comparing statistics of messages having analyzed arbitration IDs with statistics for messages having the analyzed arbitration IDs in a training dataset of CAN bus messages and labeling a temporal pattern of messages on the CAN bus as anomalous if the statistics comparison indicates a statistically significant deviation from the training dataset of CAN bus messages wherein the analyzed arbitration IDs include arbitration IDs that appear in the training dataset of CAN bus messages and satisfy a periodicity criterion in the training dataset of CAN bus messages wherein an arbitration ID satisfies the periodicity criterion if t ima , max t ima , min ≤ T p where T p is a threshold and t ima,max and t ima,min are a maximum inter-message arrival time and a minimum inter-message arrival time, respectively, over a time window; and issuing an alert if an alert criterion is met that is based on the outputs of the state space classification and the temporal pattern analysis.