Philipp Meyer: Detecting Anomalies in TSN

As modern software-defined vehicles increasingly rely on Time-Sensitive Networking (TSN) over Ethernet for critical in-vehicle communication, they become susceptible to cyberattacks and traffic anomalies that can compromise In-Vehicle Networks (IVNs). A key mechanism to protect these real-time systems is the detection of abnormal behavior induced by errors, failures, or attacks.
This presentation details a holistic approach to anomaly detection in time-sensitive IVNs, encompassing the acquisition of data from a physical vehicle demonstrator, the design of a systematic assessment framework, and the development and evaluation of two independent detection methodologies.
The first approach leverages built-in TSN features for per-stream filtering and policing, achieving real-time detection of major anomaly classes with zero false positives and no dedicated link-monitoring overhead.
The second approach employs a dedicated clustering-based method that analyzes per-stream statistics in a multidimensional feature space to classify subsequent stream intervals using distance and weight computations.
Evaluated across extensive microbenchmarks and complex automotive scenarios, both approaches successfully detect critical link-layer misbehaviors, enabling real-time countermeasures to secure IVNs against cyberattacks and system failures.