Universally applicable signal-based controller area network (CAN) intrusion detection system
US12282548B2 · kind B2 · utility
Assignee
Inventors
Key dates
| Filing date | Apr 21, 2022 |
| Grant date | Apr 22, 2025 |
| Priority date | — |
| Expiry date | Feb 28, 2043 |
Classification
- Technology area (CPC H)Electricity
- CPC primaryH04L2012/40215
- WIPO fieldDigital communication
- WIPO sectorElectrical engineering
Abstract
A system and method for intrusion detection on automotive controller area networks. The system and method can detect various CAN attacks, such as attacks that cause unintended acceleration, deactivation of vehicle's brakes, or steering the vehicle. The system and method detects changes in nuanced correlations of CAN timeseries signals and how they cluster together. The system reverse engineers CAN signals and detect masquerade attacks by analyzing timeseries extracted from raw CAN frames. Specifically, anomalies in the CAN data can be detected by computing timeseries clustering similarity using hierarchical clustering on the vehicle's CAN signals and comparing the clustering similarity across CAN captures with and without attacks.
Source: USPTO / EPO open patent data. Objective bibliographic and citation counts.