Automotive Multicast Message Sequence Graph Anomaly Detection

The patent introduces an intermediary analysis system that sits between the multicast communication and the anomaly detection. This intermediary collects messages, reconstructs transactional sequences, and creates representations that can be analyzed for anomalies. The intermediary translates the obscured multicast messages into a format that enables detection while preserving the original communication simplicity.

The patent segments the complex task of anomaly detection into multiple manageable components: message collection, sequence reconstruction, pattern identification, and anomaly detection. By breaking down the problem into these segments, the system can handle the complexity of multicast communications systematically without requiring changes to the underlying communication protocol.

The patent creates a copy or representation of the message sequence that contains the necessary tracing information. Instead of modifying the actual multicast messages to include source/destination addresses, the system creates a parallel representation that captures the transactional relationships. This copy can be analyzed for anomalies while the original simple multicast protocol remains unchanged.

The system performs preliminary actions by collecting and storing message sequences before anomaly detection is needed. It reconstructs transactional contexts in advance, creating a database of expected message patterns. When anomaly detection is required, the system can quickly compare current messages against the pre-established patterns without needing complex real-time analysis.

The system performs self-service by automatically collecting, analyzing, and establishing baselines from the actual network traffic. Instead of requiring manual configuration of expected message sequences, the system monitors the network, identifies recurring transactional patterns, and creates baselines autonomously. This self-service approach simplifies baseline establishment while maintaining high detection accuracy.

The system implements feedback mechanisms where the anomaly detection results feed back into the baseline establishment process. When anomalies are detected, the system can adjust and refine its baselines accordingly. This continuous feedback loop allows the system to adapt to changing network conditions while maintaining accurate anomaly detection, reducing the need for complex manual baseline configuration.