In-vehicle network invasion detection method and system

Abstract

The invention discloses an in-vehicle network invasion detection method and system. The system comprises a timing module, a detection module, and a learning module; The timing module is used for transmitting the operation time of the system to the communication module, and the communication module records the timestamp of the receiving time of a received message and the identity label of a messagetransmitting node according to the operation time of the system. The communication module is used for transmitting the identity label and the timestamp of the receiving time to the learning module and the detection module. The learning module is used for determining a clock drift theoretical value of the transmitting node according to the timestamp of the receiving time when a network is normal,and carrying out the binding of the clock drift theoretical value with the identity label of the transmitting node. The detection module is used for determining the deviation of the clock drift of thetransmitting node relative to the clock drift theoretical value according to the timestamp of the receiving time during invasion detection. The system provided by the invention can be directly installed on a T-Box communication module, and the method and system are good in universality, and can guarantee the network safety of most vehicles.

Description

technical field [0001] The invention relates to the field of automobile network security, in particular to a method and system for intrusion detection of an in-vehicle network. Background technique [0002] Modern cars are gradually developing towards networking and intelligence. The number of electronic control units (ECU, Electronic Control Unit) on each car has increased rapidly, reaching nearly a hundred. In order to allow cars to provide more convenient functions and services for users, while the electronic and electrical systems of cars are becoming more and more complex, interfaces for communication with the outside world have also been added, such as: WIFI, Bluetooth, 3G / 4G communication, USB and other interfaces. For intelligent connected cars, the telematics processor (T-Box, Telematics Box) is a gateway device connecting the car's internal network and external network, providing the car with external communication functions, and realizing the interconnection with ...

AI Technical Summary

Problems solved by technology

However, most of the existing intrusion detection methods are aimed at networks in the IT field, and cannot be applied to intrusion detection of in-vehicle networks.

Images