A CAN bus flood attack defense system and method

Abstract

The invention discloses a CAN bus flood attack defense system. The system includes a detection module and a filter module. The detection module is used to detect whether the CAN bus is attacked and obtain the number of malicious attack messages; the filter module uses Identify and output normal communication packets from the sequence of packets containing attack packets. The invention also provides a method based on the system. The invention solves the problem that there is no filtering strategy for malicious attack messages at present, can detect and filter data in real time, and improves the safety of the vehicle system.

Description

Technical field [0001] The present invention belongs to the field of information security technology, relates to an on-board defense system and method, in particular to a CAN bus flood attack defense system and method. Background [0002] Modern cars rely on electronic control unit ECUs (electronic control units) to control many subsystems, which communicate via bus connections. Developed by BOSCH in the early 1980s, the automotive CAN (Controller Area Network) bus is a serial bus that uses the voltage difference between the two wires of a twisted pair cable for serial communication at speeds up to 1MB / s, and has become the standard protocol for modern automotive buses. Each ECUs connected to the CAN bus transmit data by setting the voltage difference between the two twisted pairs as a signal, while other ECUs on the CAN bus receive data by detecting the voltage difference. Since the ECU directly controls most of the sensors and execution modules of the car, interference and dece...

AI Technical Summary

Problems solved by technology

Although this method can detect the injection attack of vehicle CAN, there are some deficiencies: first, the gateway plays a very important role as a bridge for inter-network communication, and this detection method uses the gateway to monitor the communication of all identifiers. Once the calculation load of the gateway exceeds the calculation capacity of the gateway, it will inevitably lead to failure of the vehicle communication network; secondly, although the legal data segment value is between the maximum value and the minimum value it saves, it is between the maximum value and the minimum value. The data value is not necessarily legal, so this method may miss some illegal attack data frames; finally, the CAN bus generates some erroneous data frames due to some reasons (such as physical interference) during actual communication, the standard CAN protocol These data frames will be dropped and will not cause failure to the overall system operation, but this detection method will mistake it for an injection attack and sound an alarm

When the traffic on the bus surges or the cycle is disordered, it is certain that the CAN bus has suffered from injection estimation, but this feature alone cannot achieve the purpose of filtering out the messages injected into the bus.

Images