Method and apparatus for calibrating a system for identifying intrusion attempts

Abstract

The invention relates to a method and a device for calibrating a system for detecting intrusion attempts. The method and the device for calibrating a system for detecting intrusion attempts in a computer network, in particular in a computer network of a motor vehicle, wherein at least one parameter is estimated from a data set, wherein the data set comprises values ​​that characterize the detected occurrence of messages in the computer network; a distribution function is determined from the at least one parameter; an inverse function of the distribution function is determined; and at least one limit of the values, usually for rule-based detection of intrusion attempts in the computer network, is calibrated from the inverse function.

Description

Technical Field

[0001] The invention relates to a method and a device for calibrating a system for detecting intrusion attempts in a computer network, in particular a computer network of a motor vehicle. Background Art

[0002] Intrusion attempts in computer networks are detected, for example, on a rule-based basis by monitoring, using rules, whether the cycle times of actually occurring periodic messages lie within a predefined time interval for the deterministic sending of these messages in the computer network.

[0003] These rules are statically determined by defining limits for the predefined time interval. If the value of the cycle time is outside of these limits, an intrusion attempt is detected.

[0004] It is therefore desirable to determine the limits so that no "false positive (False Positive, FP)" reports occur and so that "false negative (False Negative, FN)" reports are avoided. Summary of the invention

[0005] This is achieved by the method and device according to the invention.

[0006] A method for calibrating a system for detecting intrusion attempts in a computer network, in particular a computer network of a motor vehicle, provides for: estimating at least one parameter based on a data set, wherein the data set includes values ​​that characterize the detected occurrence of messages in the computer network; determining a distribution function of these values ​​based on the at least one parameter; determining an inverse function of the distribution function; and calibrating at least one limit of the values, which is usually used for rule-based detection of intrusion attempts in the computer network, based on the inverse function. The method can be applied to rules in which time intervals are determined as limits. These limits are determined based on data. Possible asymmetries in the data are thus also taken into account in these limits. As a result, the number of "false negative" reports is reduced in the case of significantly shorter time intervals. Only a small number of driving tests are required for calibration. Based on this, the calibration is performed automatically.

[0007] Preferably, a probability is predefined and the at least one limit is determined as a function value of the inverse function for a function argument that is determined as a function of the probability. Thus, a fixed probability, for example 90%, is used in order to calibrate the sensitivity of the identification.

[0008] Preferably, an extreme value is predefined and the at least one limit is determined as a function value of an inverse function for a function argument that is determined as a function of the probability and the extreme value. This method has the advantage that no "false positive" reports exist on the training data set itself.

[0009] Preferably, a lower limit of the value is determined, wherein the lower limit characterizes the value below which an intrusion attempt is detected. For example, an excessively high periodic repetition of a detected message can thus be detected as an intrusion attempt.

[0010] Preferably, a minimum of these values ​​is determined and the lower limit is determined as a function of the function value of the inverse function at this minimum.

[0011] Preferably, an upper limit of the value is determined, wherein the upper limit characterizes the value, when exceeded, of an intrusion attempt to be detected. For example, an excessively low periodic repetition of a detected message can thus be detected as an intrusion attempt.

[0012] Preferably, a maximum of these values ​​is determined and the upper limit is determined as a function of the function value of the inverse function at this maximum value.

[0013] Preferably, these values ​​characterize: a time difference between occurrences of messages detected in a computer network; an average time difference between occurrences of messages detected in a computer network; a rate of change of occurrences of messages detected in a computer network; an average rate of change of occurrences of messages detected in a computer network; or a correlation coefficient for occurrences of messages detected in a computer network. These values ​​can be extracted particularly well from measurements in a computer network.

[0014] Preferably, the values ​​are determined based on measurements of messages detected in the computer network. Measurements of messages can be incorporated particularly easily in the computer network.

[0015] A device for calibrating a system for identifying intrusion attempts in a computer network, in particular a computer network of a motor vehicle, comprises a processor and at least one data memory, wherein the processor and the at least one data memory are configured to: estimate at least one parameter based on a data set, wherein the data set comprises values ​​that characterize a detected occurrence of a message in the computer network; determine a distribution function of these values ​​based on the at least one parameter; determine an inverse function of the distribution function; and calibrate at least one limit of the values, typically for rule-based identification of intrusion attempts in the computer network, based on the inverse function. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Other advantageous embodiments are apparent from the following description and the accompanying drawings. In the accompanying drawings:

[0017] Figure 1 schematically illustrates portions of a computer network;

[0018] Figure 2 A diagram schematically illustrates the extraction of data;

[0019] Figure 3 The steps in the method are shown schematically. DETAILED DESCRIPTION

[0020] Figure 1 Part of a computer network 100 is schematically shown.

[0021] In this example, computer network 100 includes a bus 102 , in particular a controller area network (Controller Area Network) bus, which connects devices 104 , in particular motor vehicles, to one another.

[0022] In this example, the devices 104 each comprise a processor 106 and each comprise a data memory 108. It is assumed that the devices 104 are calibrated for use in a system for detecting intrusion attempts in a computer network 100.

[0023] The processor 106 and the data memory 108 are configured to execute the method described below.

[0024] The method is described for the example of periodic message transmission on a controller area network. In this example, the occurrence of messages with the same CAN-ID is detected. In this example, the message with this CAN-ID should be transmitted in a normal state at a determined cycle time μ. s to send.

[0025] In this example, measurements on the bus, so-called CAN traces, are detected from which the time stamps of the messages with the CAN ID can be extracted. In this example, the cycle time μ between immediately consecutive messages with the CAN ID is determined as a parameter for the estimation, in particular from the time stamps. Values ​​x are determined from the actually occurring cycle times μ, which characterize the detected occurrence of the messages in the computer network. This generates a data set X which contains the values ​​x.

[0026] In this example, if one or more of these cycle times μ are within the time interval of the allowed cycle times Otherwise, an intrusion attempt is identified.

[0027] The following statistical method is used as a basis, which is based on the Fisher-Tippett-Gnedenko theorem and the generalized extreme value distribution. A data set X as described above is given. Under the assumption that the set of independent and identically distributed random variables can be approximately calculated by any permutation of the data set X: In the case of n approaching ∞, the extreme value distribution of the nth-order statistic approaches the distribution function G i (z). For the following description, data set X and set has the same meaning. Distribution function G i (z) is related to the following parameters:

[0028] (i) The expected value μ of the nth-order statistic i ;

[0029] (ii) Standard deviation σ of the nth-order statistic i ;

[0030] (iii) Shape parameter Γ of the nth-order statistic i .

[0031] Parameter μ i , σ i and Γ i Can be helped by group This is achieved, for example, by means of a maximum likelihood estimation method, a generalized maximum likelihood estimation method, a Bayesian estimation method, an L-moment estimation method or other suitable estimation methods. Since there is usually no analytical solution for these methods, these parameters are approximated numerically. For this purpose, for example, a "block maximum approach", a "threshold excess approach" or other suitable estimation methods are selected.

[0032] For the parameter μ i , σ i and Γ i The estimation methods of are fully described in the literature.

[0033] If i approaches ∞, the extreme value distribution of the nth-order statistic approaches the distribution G1(z). The distribution G1(z) is a distribution related to the parameters μ1, σ1, and Γ1. The parameters μ1, σ1, and Γ1 can be obtained by combining If i approaches ∞, the extreme value distribution of the 0th-order statistic approaches the distribution G0(z). The distribution G0(z) is a distribution related to the parameters μ0, σ0, and Γ0. The parameters μ0, σ0, and Γ0 can be obtained by combining To estimate.

[0034] If we determine the parameter μi , σ i and Γ i The estimated value of , then there exists a distribution function G as follows i (z), i∈{0,1}:

[0035] (i) If Γ i <0, then it is Weibull distribution, and therefore:

[0036] If y<0, then G i (z) = exp((-y) ∝ )

[0037] If y ≥ 0, G i (z)=0

[0038] in

[0039]

[0040] y=-(1+Γ i (z-μ i ) / σ i )

[0041] (ii) If Γ i > 0, then it is a Fréchet distribution, and therefore:

[0042] If y>0, then G i (z) = exp(-y ∝ )

[0043] If y≤0, then G i (z)=0

[0044] in

[0045]

[0046] y=1+Γ i (z-μ i ) / σ i

[0047] (iii) If Γ i = 0, then it is a Gumbel distribution, and therefore

[0048] G i (z) = exp(-exp(-z-μ i ) / σ i ))

[0049] Distribution function G i (z) can be used to invert the function. To express.

[0050]

[0051] Using the distribution function G i (z) in order to calibrate the limits, that is, to find the permissible limits for the cycle time μ in the specific example

[0052] To do this, different methods can be used:

[0053] (i) A fixed probability p, such as 0.9, can be used to estimate the time interval

[0054]

[0055] In this case it should be noted that the closer the probability p is to the value 1, the more reliably these limits will not be violated later in the application.

[0056] (ii) It is possible to determine the group In this example, the calculation is Group The minimum value m and the maximum value M of . Next, calculate the probability

[0057] [p0, p1]=[G0(m), G1(M)].

[0058] A small value p, such as 0.1, is added to the probability [p0, p1]. This way, the time interval is estimated to be

[0059]

[0060] This method has the following advantages: There is no possibility of "false positive" reports on the training data set. Absence The value of X i It's called a "false positive."

[0061] Alternatively, p may be selected differently individually for p0 and p1.

[0062] In this example, the limit is determined is used to create rules for the cycle time μ for the considered messages with the same CAN-ID.

[0063] The described method can always be used in the configuration as soon as minimum, maximum or minimum and maximum limits are required for the rule. In addition to the cycle time μ, this can also include, for example, the consideration of value ranges, rates of change, correlation coefficients or corresponding mean values ​​of certain signals.

[0064] exist Figure 2 The pair Messages with the same CAN ID, namely A, are considered with regard to their cycle time μ and data sets X=0.0003, 0.0002, 0.0003, 0.0004, . . . are extracted.

[0065] in accordance with Figure 3 A method for calibrating a system for detecting intrusion attempts in a computer network, in particular a computer network of a motor vehicle, is described.

[0066] The method starts from the fact that there is a measurement of messages detected in a computer network, in this example a CAN measurement, which is Figure 3 It is represented by CANTrace (CAN record).

[0067] In step 302 , values ​​x are determined from one or more measurements, which values ​​x characterize detected occurrences of messages in the computer network.

[0068] In step 304 , a data set X comprising these values ​​x is determined.

[0069] In the optional step 306, the data set X is preprocessed, for example, the data set X is mixed.

[0070] In step 308, the parameter μ is estimated based on the data set X. i , σ i and Γ i , where i∈{0,1}. To this end, by means of the above-mentioned parameter μ i , σ i and Γ i The estimation method is used for processing.

[0071] In step 310, according to the parameter μ i , σ i and Γ i , where i∈{0,1} determines the distribution function G i (z). In step 310, the distribution function G is determined i The inverse function of (z) (where i∈{0,1}) . To do this, use one of the methods described above.

[0072] In step 312, the probability [p0, p1] is determined. To this end, the above-described method is used.

[0073] As an alternative or in addition, the probability p can be predetermined as described above. If the probability p is predetermined, then according to the inverse function in the case of the following function argument The function value is used to determine the lower limit The function argument is determined according to the probability p. Alternatively or additionally, the inverse function can be determined according to the following function argument: The function value of determines the upper limit The function argument is determined according to the probability p.

[0074] It is also possible for an extreme value to be predefined and for one of the limits to be determined as a function of the function value of the inverse function for a function argument that is determined as a function of the probability p and the extreme value.

[0075] The minimum value m of the value x can be determined. In this case, the lower limit is determined, for example, based on the function value of the inverse function G0(m) in the case of the minimum value m. Alternatively or additionally, a maximum value M of the value x can be determined. In this case, the upper limit can be determined from the function value of the inverse function G1(M) in the case of the maximum value M:

[0076] In particular, the probability [p0, p1]=[G0(m), G1(M)] can be determined.

[0077] In step 314, according to the inverse function (where i∈{0,1}) and probability [p0,p1] and / or probability p to determine at least one limit To do this, use one of the methods described above.

[0078] In step 316, the at least one limit of the value x Typically implemented for rule-based identification of intrusion attempts.

[0079] Then, the method ends.

[0080] For example, determine the lower limit of the value x The lower limit characterizes the value x below which an intrusion attempt is detected.

[0081] For example, determine the upper limit of the value x The upper limit characterizes the value x, when exceeded, of which an intrusion attempt is detected.

[0082] In this example, these values ​​x characterize the time differences between the occurrences of messages detected in the computer network. Values ​​characterizing: the average time difference between the occurrences of messages detected in the computer network; the rate of change of the occurrences of messages detected in the computer network; the average rate of change of the occurrences of messages detected in the computer network; or a correlation coefficient for the occurrences of messages detected in the computer network may also be used.

Claims

1. A method for calibrating a system for identifying intrusion attempts in a computer network, characterized in that Estimate at least one parameter (μ) from a data set (X) i , σ i , Γ i , i∈{0,1}), wherein the data set (X) comprises a value z characterizing a detected occurrence of a message in the computer network; According to the at least one parameter (μ i , σ i , Γ i , i∈{0,1}) to determine the distribution function G of the value z i (z); Determine the distribution function G i The inverse function of (z) And according to the inverse function to calibrate at least one limit of the value z which is typically used for rule-based identification of intrusion attempts into the computer network 2. The method according to claim 1, characterized in that The computer network is a computer network of a motor vehicle.

3. The method according to claim 1, characterized in that Given a probability p, and according to the inverse function in the case of the following function argument The function value of the at least one limit is determined The function argument is determined according to the probability p.

4. The method according to claim 3, characterized in that The extreme values ​​(p0, p1) are given in advance, and the inverse function is obtained according to the following function arguments The function value of the at least one limit is determined The function argument is determined according to the probability p and the extreme value (p0, p1).

5. The method according to any one of claims 1 to 4, characterized in that Determine the lower limit of the value z The lower limit Characterizes the value z below which an intrusion attempt is detected.

6. The method according to claim 5, characterized in that Determine the minimum value m of the value z, and according to the inverse function at the minimum value m The lower limit is determined by the function value 7. The method according to any one of claims 1 to 4, characterized in that Determine the upper limit of the value z The upper limit Characterizes the value z, when exceeded, of which an intrusion attempt is detected.

8. The method according to claim 7, characterized in that Determine the maximum value M of the value z, and according to the inverse function at the maximum value M The upper limit is determined by the function value 9. The method according to any one of claims 1 to 4, characterized in that The value z characterizes: the time difference between occurrences of messages detected in the computer network; the average time difference between occurrences of messages detected in the computer network; a rate of change of occurrences of messages detected in said computer network; an average rate of change of occurrences of messages detected in said computer network; Or a correlation coefficient for the occurrence of a message detected in said computer network.

10. The method according to any one of claims 1 to 4, characterized in that The value z is determined based on a measurement of messages detected in the computer network.

11. A device (104) for calibrating a system for identifying intrusion attempts in a computer network (100), characterized in that The device (104) comprises a processor (106) and at least one data memory (108), wherein the processor and the at least one data memory are configured to estimate at least one parameter (μ) from a data set (X) i , σ i , Γ i , i∈{0,1}), wherein the data set (X) comprises a value z characterizing the detected occurrence of a message in the computer network; i , σ i , Γ i , i∈{0,1}) to determine the distribution function G of the value z i (z); Determine the distribution function G i The inverse function of (z) And according to the inverse function to calibrate at least one limit of the value z which is typically used for rule-based identification of intrusion attempts into the computer network 12. The device (104) according to claim 11, characterized in that The computer network (100) is a computer network of a motor vehicle.

Images