Device and method for anomaly identification in a communication network

Abstract

Device and method for anomaly recognition in a communication network, wherein at least two messages at a port of the communication network are observed (304), wherein a characteristic of a communication behavior of a network member is determined (308) based on the at least two messages, wherein a deviation of the characteristic from an expected characteristic is determined (308), and wherein if the deviation deviates from an allowable deviation, the presence of an anomaly is recognized (314), wherein the expected characteristic defines the communication behavior of at least one network member based on a network architecture, in particular a static one, of the communication network.

Description

Technical Field

[0001] The starting point of the present invention is a device and a method for detecting anomalies in a communication network, in particular in a vehicle. Background Art

[0002] Network Intrusion Detection and Prevention Systems (NIDPS) are used to detect anomalies and, if necessary, to react to detected anomalies. This increases the operational safety of the communication network, in particular with regard to attack scenarios.

[0003] It is desirable to further improve the operational reliability of communication networks, in particular of vehicles. Summary of the invention

[0004] This is achieved by the device and method according to the invention.

[0005] In order to provide a NIDPS for a vehicle network, the differences between a vehicle network and an enterprise network should be considered, such as their network structure, network dynamics, and their network nodes.

[0006] Network structure:

[0007] Enterprise networks usually follow a client-server model, in which there are a small number of dedicated server network nodes that provide services to a usually larger number of client network nodes. Automotive networks consist of ECUs on which both server and client applications are implemented.

[0008] Enterprise networks are usually much larger and more complex than automotive networks. The entire enterprise network is usually more segmented and physically or logically divided into different zones and subnets. The ECUs in a typical automotive network are only divided into a few subnets, if any, via so-called "gateways" or are logically separated at the Ethernet level via so-called "Virtual Local Area Networks (VLANs)".

[0009] Network dynamics:

[0010] Enterprise networks and automotive networks differ in the dynamics used to change and operate the networks.

[0011] In an enterprise network, network nodes can be replaced at will. For changes at a server network node, it is usually also possible to perform adaptations in the configuration of a defense system, such as NIDPS. This configuration is impossible at a client network node. The reason is that the client is connected to the network from a constantly changing location and is often replaced. In addition, it is not possible to accurately predict which applications are implemented on the client.

[0012] ECUs in car networks are rarely replaced, if at all, and then often only replaced by identical copies. As a result, it is unlikely that any changes will occur in the working principle of the network. In car networks, the network nodes are well known. Likewise, the server and client applications that run on them are clearly defined, and the details about the network communication can be predetermined.

[0013] In an enterprise network, external nodes can establish a connection to the internal company network. In an automotive network, all communication nodes of the network are part of the vehicle's internal network.

[0014] In an enterprise network, different users can usually use the same client. In the ECU of a car network, there are no users, but only server and client applications.

[0015] Network Nodes:

[0016] In terms of resources, the network nodes of an enterprise network are often many times more resource-intensive (eg with regard to storage and performance) than the ECUs of an automotive network.

[0017] In terms of software, in enterprise networks, network nodes are mostly equipped with widely popular standard operating systems and standard software, for which security vulnerabilities are known. Therefore, the focus of NIDPS systems in enterprise networks is to identify based on signatures when attempts to exploit known security vulnerabilities are made. Network nodes in automotive networks are often equipped with less popular software. Most of the signatures from NIDPS systems for enterprise networks cannot be used, and there is no large database of known vulnerabilities specifically for automotive networks.

[0018] Although the basic task of NIDPS, that is, detecting anomalies in network transmission and reacting to anomalies in network transmission, is the same in the case of enterprise networks and automobile networks, it can be seen from the above-mentioned points that the basic working principle of an effective NIDPS for automobile networks must in principle be different from the basic working principle of NIDPS for enterprise networks. NIDPS for automobile networks must use known and static network structures and much lower dynamics of network members so that anomalies can be effectively detected using limited resources.

[0019] The method for anomaly identification in a communication network provides for observing at least two messages at a port of the communication network, wherein a characteristic of a communication behavior of a network member is determined based on the at least two messages, wherein a deviation of the characteristic from an expected characteristic is determined, and wherein if the deviation deviates from an allowable deviation, an anomaly is identified, wherein the expected characteristic defines the communication behavior of at least one network member according to a particularly static network architecture of the communication network. By this, in an automotive Ethernet, network transmissions at an existing Ethernet port are analyzed and anomalies caused by an attacker in the network are identified. This may be implemented, for example, on an automotive Ethernet switch, on a hardware port of the automotive Ethernet switch, that is, on a switch port of the automotive Ethernet switch, or on a hardware port of any member on the automotive Ethernet in a vehicle. Anomaly identification is based, for example, on an analysis of at least two Ethernet packets and a derivation of the communication behavior of a network member obtained therefrom. If the observed communication behavior of a network member deviates too much from the expected communication behavior, an anomaly is detected. The term Automotive Ethernet refers to Ethernet technologies such as 100BASE-T1 version 1.0, 1000BASE-T1 or 100BASE-TX.

[0020] Preferably, the expected characteristic is determined based on a model, which models the communication behavior of the network members. The model models the communication behavior. In the vehicle, the model is defined based on knowledge about the vehicle.

[0021] Preferably, a measure of the severity of the anomaly is determined as a function of the characteristics of the communication behavior of at least one network member, the expected characteristics and / or the deviation, wherein the reaction is determined as a function of the severity of the anomaly. This allows the reaction to be determined particularly well as a function of the result of the anomaly detection.

[0022] It is particularly advantageous if the reaction is selected from a plurality of defined reactions depending on the severity of the anomaly. For a vehicle, the reaction is defined, for example, based on knowledge about the vehicle. From these reactions, the reaction most suitable for the respective severity of the anomaly is selected and implemented. This significantly improves the operational safety of the vehicle.

[0023] Preferably, it is provided that the reaction includes: reporting to a central authority; discarding one of the messages, in particular a data packet of a message; and / or switching the communication network to a safe state, thereby triggering a suitable reaction.

[0024] Preferably, the model is defined as a function of information about a static part of the communication network, in particular preferably a static network architecture of the vehicle, wherein the expected behavior is defined as a function of information about the static part of the communication network, in particular the static network architecture.

[0025] It is preferably provided that the expected characteristic defines a ratio between a first data volume and a second data volume in the data exchanged, in particular within a defined time period, wherein a first data packet or message, whose sender is a first network member and whose receiver is a second network member, defines the first data volume, and a second data packet or message, whose sender is a second network member and whose receiver is a first network member, defines the second data volume. For example, it is predetermined by system knowledge that the ratio between the first data volume and the second data volume should be 3:1 between the first control unit ECU_A and the second control unit ECU_B. If it is now detected that the ratio is 10:1 within a certain time period, the deviation is 7 in this example. If the permissible deviation is, for example, 4, then in this example, the deviation exceeds the permissible deviation. As a result, an anomaly is detected in this case. If the permissible deviation is, for example, 8, then no anomaly is detected in this case.

[0026] Preferably, during the anomaly detection, a distinction is made between different system states in which the vehicle is located, in particular between the system states ignition, engine idling, forward driving, reverse driving or performing vehicle diagnosis, wherein the system state of the vehicle is determined and wherein the expected behavior is determined as a function of the system state. This distinction is particularly meaningful if the network transmission behaves in a uniform manner in the same system state, although it may differ significantly in different system states. The network transmission can then be modeled by its basic characteristics. For example, different tolerances are predefined for different system states.

[0027] In one aspect, a measure of the deviation is determined at a synchronous or asynchronous time point, and a comparison of the measure of the deviation with a threshold defining the tolerance is performed. The measure may be a deviation of the ratio described previously from the ratio of the amount of data expected by system knowledge. In this case, the threshold may describe a numerical parameter of the tolerance. The comparison at the synchronous time point may be performed, for example, at intervals of a certain period of time. Asynchronous monitoring may be performed, for example, after analyzing a fixed number of packets.

[0028] In one aspect, the model defines the expected behavior as a function of a predetermined expiration of a network protocol used in the communication network. This allows different treatments for different protocols instead of or in addition to the system state. This allows higher deviations to be tolerated in protocols that are not critical with regard to the operational safety of the vehicle than in protocols that are safety-relevant with regard to this aspect.

[0029] Preferably, it is provided that: the model defines metrics about data transmission, especially aggregated by counters or leaky bucket mechanisms, especially metrics about data transmission per last time unit and / or per communication member, especially the number of transmitted data packets, the average size of transmitted data packets, the average number of network connections, the average amount of data per network connection, the number of interrupted network connections, the response time or the ratio between the data sent and the data received. Here, these metrics can be calculated for different dimensions. Two dimensions that can be used exemplarily are every x last time units and / or each communication member. For counting per time unit, using a counter is an advantageous mechanism to determine when the metric is too high, wherein, for example, the frequency of occurrence of a certain event is counted. Another mechanism is a leaky bucket mechanism, which uses a leaky bucket counter. The leaky bucket counter has the following advantages: unlike a counter, a temporary increase in the metric will be allowed during a certain time period. Thus, if network activity is used as a metric, an abnormality is not immediately detected due to, for example, a temporary increase in network activity.

[0030] Preferably, it is provided that the deviation is determined based on information about the network protocol used by the network member, in particular based on one of the network protocols Ethernet, IPv4 / IPv6, TCP / UDP, SOME / IP, DDS, DoIP and AVB. This differentiation enables consideration of protocol-specific differences.

[0031] The device for detecting anomalies in a communication network provides that the device comprises a port and a computing device, which are designed to carry out the method. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Further advantageous embodiments are apparent from the following description and the accompanying drawings. In the drawings:

[0033] Figure 1 A schematic diagram showing a communication network in a vehicle;

[0034] Figure 2 A schematic diagram of an anomaly identification system for the communication network is shown;

[0035] Figure 3 Steps in a method for anomaly detection in the communication network are shown. DETAILED DESCRIPTION

[0036] Figure 1A communication network 100 in a vehicle 102 is schematically shown. The communication network 100 comprises a first network member 104, a second network member 106 and a connection element 108. The connection element 108 is, for example, a switch, in particular an automotive Ethernet switch. The connection element 108 comprises at least one port 110, in particular a hardware port. This port is also referred to as a hardware switch port. Figure 1 Schematically shown are two ports 110, more or fewer ports 110 may also be provided. The connection element 108 is configured to process messages that enter at one of the ports 110. These messages may be output or discarded at this port 110 or at another port 110. The connection element 108 comprises a computing device 112, which is configured to process these messages. The computing device 112 may be implemented as part of the switch hardware 114. The computing device 112 may be arranged in a distributed manner, in particular distributed to a part of the switch hardware 114 and a microcontroller 116, which is connected or connectable to the part of the switch hardware 114 via a data line 118.

[0037] The device for anomaly identification described in detail below includes a port 110 and a computing device 112. The device is Figure 2 At least a part of an anomaly identification system 200 for a communication network 100 is schematically shown in FIG. The anomaly identification system is hereinafter referred to as a Network Intrusion Detection and Prevention System (NIDPS).

[0038] The NIDPS 200 includes a model 202 for expected network behavior. In this example, the model 202 models the expected network behavior of each port 110, in this example, each Ethernet port. It is also possible to model the network behavior between two network members, in particular the first network member 104 and the second network member 106. In this example, the model 202 is based on system knowledge about the communication network 100. This system knowledge, for example, relates to the topology of the communication network 100 or information about data exchange between network members in the communication network 100.

[0039] The NIDPS 200 includes an observer 204 for observed network behavior. In this example, the observer 204 observes the expected network behavior of each port 110, in this example, each Ethernet port. The network behavior between two network members, in particular the first network member 104 and the second network member 106, can also be observed.

[0040] The NIDPS 200 includes a presetting device 206, which is configured in this example to preset a tolerance. The tolerance can be pre-set statically or according to the system state. Different tolerances can be pre-set for different network members or different network behaviors.

[0041] The NIDPS 200 includes a first input 208 for the system state. The NIDPS 200 can also be configured to receive information about the system state at the first input 208 and determine the system state based on the information. In this case, it can be provided that the presetting device 206 determines and / or pre-sets the permissible deviation based on the system state.

[0042] The NIDPS 200 comprises a second input 210 for data packets. In this example, these data packets are transmitted to the second input 210 from the port 110.

[0043] The NIDPS 200 comprises a first output 212 for information about the result of the anomaly identification. In the present example, information about the anomaly, that is to say a description of the type of the anomaly or a measure of its severity, is output. Other additional information or information for triggering a reaction to the anomaly may also be output. It may also be provided that the status of the anomaly identification is output, which indicates whether an anomaly is present.

[0044] The NIDPS 200 may include a second output terminal 214 for a data packet. The NIDPS 200 may be configured to output a data packet on the second output terminal 214 for forwarding in the communication network 100. The NIDPS 200 may be configured to output a data packet for forwarding in the communication network 100 only when no anomaly has been identified; otherwise, the data packet is discarded. The NIDPS 200 may be configured to analyze the data packet based on its content; and forward the data packet or discard the data packet based on the result of the inspection. The NIDPS 200 may be configured to output a signal on the second output terminal instead of the data packet itself, which signal permits forwarding of the data packet or triggers discarding of the data packet.

[0045] In the following, based on Figure 3 1 to describe a method for anomaly identification. The method begins, for example, when a signal 302 places the NIDPS in a state 304 "active". In the state 304 "active", messages at the port 110 of the communication network 100 are observed. For example, the following data packets are received and / or observed at the port 110, which are assigned to these messages and / or at least partially or completely include these messages. In this example, data packets according to the automotive Ethernet standard are observed as messages.

[0046] In a first aspect, in step 306, a transition is made to state 308 "Compute" at a synchronous or asynchronous time point.

[0047] In a second aspect, if the Xth message is received, then in step 310 a transition is made to state 308 "Compute". In one example, X represents an integer of the messages. For example, a counter is used to detect how many messages have been observed since the last transition to state 308 "Compute", and a transition is made to state 308 "Compute" after at least two messages have been received since that transition.

[0048] The number of messages observed before this transition is 1 < X in this example and can in particular be X = 2, X = 5 or X = 10. It can be stipulated that only messages received by or addressed to a certain network member are observed. It is also possible to observe only messages of a certain message type or messages exchanged using a certain message protocol to determine the number X.

[0049] In state 308 "Compute", characteristics of the communication behavior of one or more network members are determined based on at least two messages.紧接着, the deviation of this characteristic from the expected characteristic is determined.

[0050] The expected characteristic defines the communication behavior of at least one network member based on the static network architecture of the communication network 100, in particular.

[0051] The expected characteristic is determined, for example, based on model 202, which models the communication behavior of the network members.

[0052] In one aspect, model 202 is defined based on information about the static part of the communication network 100. In particular, the static network architecture of the vehicle can be predefined by model 202. In this case, the expected characteristic is defined based on information about the static part of the communication network 100, in particular the static network architecture.

[0053] In one aspect, model 202 defines the expected characteristic based on a predefined expiration of the network protocol used in the communication network 100.

[0054] For example, a measure of the deviation is determined, and a comparison of the measure of the deviation with a threshold that defines the allowable deviation is performed.

[0055] For example, in the first aspect, a measure of the deviation is determined for a synchronous or asynchronous time point, and a comparison of the measure of the deviation with a threshold that defines the allowable deviation is performed.

[0056] For example, in the second aspect, a comparison of the measure of the deviation with a threshold that defines the allowable deviation is performed after the Xth message is received.

[0057] exist Figure 1 In the example shown in , a first data packet or message whose sender is the first network member 104 and whose recipient is the second network member 106 defines a first data volume. A second data packet or message whose sender is the second network member 106 and whose recipient is the first network member 104 defines a second data volume.

[0058] In this example, the expected characteristic defines a ratio between the first data volume and the second data volume. The ratio is determined in particular based on the data exchanged within a defined time period. Information about the ratio is determined, for example, by observing the data exchanged in the communication network 100.

[0059] For example, one of the network protocols Ethernet, IPv4 / IPv6, TCP / UDP, SOME / IP, DDS, DoIP and AVB is used. The number X and these data volumes are determined, for example, based on messages transmitted according to one of these network protocols. In this case, for example, the permissible deviation of the ratio is determined based on information about the network protocol used for this purpose.

[0060] Model 202 uses, for example, a counter or leaky bucket mechanism that aggregates metrics about data transmission, for example, for each last time unit and / or for each communication member.

[0061] It can be stipulated that, for data transmission in the communication network 100, the number of transmitted data packets, the average size of transmitted data packets, the average number of network connections, the average amount of data per network connection, the number of interrupted network connections, the response time or the ratio between sent data and received data are aggregated and related to the parameters modeled for this purpose.

[0062] If the deviation deviates from the permissible deviation, the presence of an anomaly is detected. The permissible deviation is determined with the aid of model 202 as a function of the expected behavior.

[0063] If no anomaly is detected, in step 312 there is a change from state 308 “Computing” to state 304 “Active”.

[0064] If an exception is detected, in step 314 there is a change from state 308 “calculate” to state 316 “respond”.

[0065] At state 316 "RESPOND", a reaction to the identified anomaly is determined. In one aspect, a measure of the severity of the anomaly is determined and the reaction is determined based on the severity of the anomaly. For example, the measure of the severity of the anomaly is determined based on characteristics of the communication behavior of one or more network members, the expected characteristics, and / or the deviation.

[0066] In this example, the response is selected from a plurality of defined responses based on the severity of the abnormality.

[0067] The reaction may include: reporting to a central authority; discarding one of the messages, in particular a data packet of a message; and / or switching the communication network 100 to a safe state. The reaction is triggered, for example, by outputting at the first output 212 of the NIDPS.

[0068] It can be provided that during the abnormality identification, a distinction is made between different system states in which the vehicle is located. For example, the following system states are distinguished: "ignition", "engine idling", "driving forward", "driving backward" or "performing vehicle diagnosis". These system states are provided, for example, via the first input 208. The permissible deviation is pre-determined by the pre-determining device 206 based on these system states. The system state of the vehicle can also be determined based on the information at the first input 208. In this respect, the expected characteristic is determined based on the system state. For example, if it is determined that the vehicle is in one of the "ignition", "engine idling", "driving forward", "driving backward" states, a smaller deviation is allowed relative to the "performing vehicle diagnosis" state.

[0069] After this reaction, a change occurs in step 318 to state 304 “active”.

[0070] The method ends, for example, as a result of a corresponding signal.

Claims

1. A method for anomaly detection in a vehicle communication network (100) within a vehicle (102), characterized in that Observing (304) at least two messages at a port (110) of the automotive communication network (100), wherein a characteristic of a communication behavior of the network members (104, 106) is determined (308) based on the at least two messages, wherein a deviation of the characteristic from an expected characteristic is determined (308), and wherein if the deviation deviates from an allowed deviation, identifying (314) the presence of an anomaly, wherein the expected characteristic is determined based on a model (202) that models a communication behavior between a first network member and a second network member, wherein the first network member comprises a first control device of the automotive communication network and the second network member comprises a second control device of the automotive communication network, wherein the expected characteristic defines the communication behavior of at least one network member (104, 106) based on a static network architecture of the automotive communication network (100) comprising the first control device and the second control device, The expected characteristic defines a ratio between a first amount of data and a second amount of data in the data exchanged within the defined time period, wherein a first data packet or message whose sender is the first network member (104) and whose recipient is the second network member (106) defines the first amount of data, and wherein a second data packet or message whose sender is the second network member (106) and whose recipient is the first network member (104) defines the second amount of data.

2. The method according to claim 1, characterized in that A measure of anomaly severity is determined based on characteristics of the communication behavior of the at least one network member (104, 106), the expected characteristics, and / or the deviation, wherein a response is determined based on the anomaly severity.

3. The method according to claim 2, characterized in that The response is selected from a plurality of defined responses based on the severity of the abnormality ( 316 ).

4. The method according to claim 2, characterized in that: The reaction includes (212): reporting to a central authority; discarding a data packet of one of the messages; and / or transitioning the automotive communication network to a safe state.

5. The method according to any one of claims 1 to 4, characterized in that A model (202) is defined based on information about a static part of the automotive communication network (100), wherein the expected characteristics are defined based on information about the static part of the automotive communication network (100).

6. The method according to claim 5, characterized in that The static part of the automotive communication network (100) is the static network architecture.

7. The method according to claim 6, characterized in that The static part of the automotive communication network (100) is the static network architecture of the vehicle (102).

8. The method according to any one of claims 1 to 4, characterized in that During the anomaly identification, a distinction is made between different system states in which the vehicle (102) is in, wherein the system state of the vehicle is determined, and wherein the expected behavior is determined (308) as a function of the system state.

9. The method according to claim 8, characterized in that During the abnormality recognition, a distinction is made between the system states ignition, engine idling, forward driving, reverse driving or performing vehicle diagnosis.

10. The method according to any one of claims 1 to 4, characterized in that The measure of the deviation is determined at a synchronous or asynchronous point in time and a comparison of the measure of the deviation with a threshold value defining the permissible deviation is performed.

11. The method according to any one of claims 1 to 4, characterized in that The model (202) defines the expected behavior as a function of a predefined expiration of a network protocol used in the vehicle communication network (100).

12. The method according to any one of claims 1 to 4, characterized in that The model (202) defines metrics about data transfer that are aggregated via counters or leaky bucket mechanisms.

13. The method according to claim 12, characterized in that The model (202) defines metrics on data transmission aggregated for each last time unit and / or for each communicating member via a counter or leaky bucket mechanism.

14. The method according to claim 13, characterized in that The metrics regarding data transmission are the number of transmitted data packets, the average size of transmitted data packets, the average number of network connections, the average amount of data per network connection, the number of interrupted network connections, the response time or the ratio between sent data and received data.

15. The method according to any one of claims 1 to 4, characterized in that The deviation is determined based on information about a network protocol used by the network members (104, 106).

16. The method according to any one of claims 1 to 4, characterized in that The deviation is determined according to one of the network protocols Ethernet, IPv4 / IPv6, TCP / UDP, SOME / IP, DDS, DoIP, and AVB.

17. A device for anomaly identification in a car communication network in a vehicle (102), characterized in that The device comprises a port (110) and a computing device (112), which are configured to implement the method according to any one of claims 1 to 16.

18. A computer program product, characterized in that The computer program product comprises a computer-readable storage medium on which a computer program is stored. The computer program comprises computer-readable instructions. When the computer-readable instructions are executed by a computer, the method according to any one of claims 1 to 16 is executed.

Images