System and Method for using Signal Waveform Analysis for Detecting a Change in a Wired Network

Abstract

An analyzer for monitoring a configuration of a wired network medium that is used for communication between multiple devices. The configuration change includes an additional device tapping to the medium for eavesdropping, or the substituting one of the devices. The analyzer is connected to the medium for receiving, storing, and analyzing waveforms of the physical-layer signals propagated over the medium. The analysis includes comparing the received signals to reference signals, and notifying upon detecting a difference according to pre-set criteria. The analysis may be time or frequency-domain based, and may use a feed-forward Artificial Neural Network (ANN). The wired network may be an automotive or in-vehicle network, PAN, LAN, MAN, or WAN, may use balanced or unbalanced signaling, and may be configured as point-to-point or multi-point topology. The analyzer may be connected at an end of the medium, and may be integrated with one of the devices.

1 . A method for use with a frame-based wired network that carry a waveform of part of a frame over medium that comprises two conductors, for use with multiple devices that are connected to, and communicate with each other over, the medium, and for use with a first memory that stores multiple waveform-related criterions, each of the criterions is associated with at least one of the multiple devices, the method comprising:
 receiving, via a connector connectable to the medium, a waveform that is transmitted to the medium by one of the multiple devices;   producing, by an Analog-to-Digital (A/D) converter that is coupled to the connector, digital samples of the received waveform;   storing, in a second memory that is coupled to the A/D converter, the digital samples;   comparing, using a software that is executed by a processor, the digital samples to the multiple waveform-related criterions in the first memory;   determining, by the software executed by the processor, whether the digital samples satisfy at least one of the waveform-related criterions; and   transmitting an error signal in response to determining that the digital samples do not satisfy any of the waveform-related criterions,   wherein the connector, the A/D converter, the first and second memories, and the processor, are housed in a single enclosure.   
     
     
         2 . The method according to  claim 1 , wherein at least one criterion out of the multiple criterions is determined as not satisfied in response to changing of, or connecting to, the medium. 
     
     
         3 . The method according to  claim 2 , wherein at least one criterion out of the multiple criterions is determined as not satisfied in response to connecting an additional device to the medium. 
     
     
         4 . The method according to  claim 3 , wherein the additional device is configured to communicate with at least one of the multiple devices when connected to the medium. 
     
     
         5 . The method according to  claim 1 , wherein at least one criterion out of the multiple criterions is determined as not satisfied in response to a change in a device from the multiple devices that is associated with the respective criterion. 
     
     
         6 . The method according to  claim 1 , further comprising, by a transceiver coupled between the connector and the processor, transmitting frames to, and receiving frames from, one or more of the multiple devices over the medium, and wherein the digital samples are formed from sampling of a signal carried differentially over the two conductors, or from samples of a signal carried between one of the two conductors and the ground. 
     
     
         7 . The method according to  claim 6 , further comprising a controller for layer 2 or layer 3 handling of the received frame, and wherein the transmitting comprises transmitting to the controller. 
     
     
         8 . The method according to  claim 7 , wherein each one of the multiple devices is associated with a digital address for uniquely identifying each of the multiple devices in the wired network, and wherein the method further comprising identifying the digital address of the device that transmitted the waveform. 
     
     
         9 . The method according to  claim 8 , wherein the digital address is extracted from the received frame. 
     
     
         10 . The method according to  claim 9 , wherein the comparing comprises comparing the digital samples to the waveform-related criterion that is associated with, is based on, or is according to, the identified digital address. 
     
     
         11 . The method according to  claim 1 , wherein the received waveform frequency spectrum is limited by a maximum component frequency, and wherein the sampling rate of the producing by the A/D converter is higher than twice the maximum component frequency. 
     
     
         12 . The method according to  claim 1 , further comprising at least partially terminating a signal propagating over the medium by an impedance or a resistor connected to the connector. 
     
     
         13 . The method according to  claim 1 , further configured to detect a malware or a malware activity, wherein the malware consists of, includes, or is based on, a computer virus, spyware, DoS (Denial of Service), rootkit, ransomware, adware, backdoor, Trojan horse, or a destructive malware. 
     
     
         14 . The method according to  claim 1 , wherein the comparing comprises measuring a value of a parameter or a characteristic using time-domain or frequency domain analyzing of the digital samples. 
     
     
         15 . The method according to  claim 1 , wherein the comparing comprises frequency-domain analyzing of the digital samples for measuring a value of a parameter or a characteristic. 
     
     
         16 . The method according to  claim 1 , wherein the comparing comprises analyzing or classifying the waveform using an Artificial Neural Network (ANN). 
     
     
         17 . The method according to  claim 16 , wherein the ANN is a Feedforward Neural Network (FNN). 
     
     
         18 . The method according to  claim 16 , wherein the ANN is a Recurrent Neural Network (RNN) or a deep convolutional neural network. 
     
     
         19 . The method according to  claim 1 , further comprising notifying a human user using auditory, visual, or haptic stimuli using an annunciator coupled to the processor, in response to determining that the digital samples do not satisfy any of the waveform-related criterions. 
     
     
         20 . The method according to  claim 1 , further comprising transmitting to the medium using a line driver or a transceiver in response to determining that the digital samples do not satisfy any of the waveform-related criterions.