Vehicle-mounted intrusion detection method and system based on ECU signal characteristic identifiers

Abstract

The invention provides a vehicle-mounted intrusion detection method based on ECU signal characteristic identifiers, in-vehicle electronic control unit (ECU) communication enables level changes to be generated in a CAN bus, and the level changes imply electronic characteristics which cannot be copied by an ECU. According to the method, inconsistent characteristics of signals generated by the ECU due to hardware inconsistency are considered, and the ECU is identified by utilizing the characteristics. The intrusion detection system capable of positioning and identifying the malicious ECU is realized by filling an extended identifier domain of a data extended frame with a section of fixed and same bit stream, analyzing signal characteristics in the bit stream, extracting entropy and other characteristics and message IDs, and learning by using a bagging decision tree algorithm.

Description

technical field [0001] The invention belongs to the technical field of intrusion detection, and in particular relates to a method for identifying an ECU by using signal characteristics to realize intrusion detection of a vehicle-mounted CAN bus. Background technique [0002] In the early days, electronic control units (ECUs) were proposed to control automotive components such as engines. In recent years, with the introduction of advanced electronic technology, many safety, comfort and entertainment functions have been integrated in automobiles, and a large number of ECUs have been used in automotive electronic systems to enhance driving experience. ECUs communicate through the control area network (CAN), but the CAN protocol did not consider the security features at the beginning of the design, and does not support message source authentication, which makes the communication between ECUs have certain security risks. Therefore, it is very necessary to detect and report abnor...

AI Technical Summary

Problems solved by technology

[0003] The problem of message source authentication can generally be solved by using message authentication code (MAC) technology, but the short frame structure of the CAN bus cannot support the traditional MAC method

On the one hand, most of the previous solutions were to improve the MAC to apply to the CAN bus, but these methods have problems such as requiring hardware modification and excessive bus load

On the other hand, hardware differences make different ECUs generate different signal levels even if they send the same message

Images