Intrusion detection system construction device and method using intrusion detection rule applied to CAN communication

Abstract

The invention discloses an intrusion detection system construction device and method applied to controller area network (CAN) communication. The intrusion detection system construction method applied to controller area network (CAN) communication according to one embodiment of the present invention may comprise the steps of: analyzing an input file associated with controller area network communication to extract standard information; setting a detection strategy rule by using the extracted standard information and applying at least one of a fixed rule set and a user-defined rule set; and packaging the standard information and the detection strategy rule to generate a strategy file applied to the intrusion detection system.

Description

Technical Field

[0001] The present invention relates to an intrusion detection system construction device and method applied to controller area network (CAN) communication. Background Art

[0002] Recently, in addition to automotive electronic control, local modules that support driving assistance functions such as autonomous driving are being actively developed. In particular, automotive IT convergence technologies that support sensing technologies such as LiDAR (distance measurement / object recognition sensors) and external communication technologies (V2X, Vehicle to Everything) are being developed for full self-driving automation.

[0003] In order to effectively transmit the various information of the above-mentioned various technologies, the electronic control unit (ECU) inside the car can control information sharing and the car through the internal car network (controller area network (CAN, Controller Area Network), vehicle Ethernet (Ethernet)).

[0004] Therefore, the security needs for protecting information transmitted inside and outside the car are also gradually increasing. For example, although an intrusion detection system (IDS) has been developed to detect network attacks inside the car, there is still an increasing demand for technologies that can detect attacks using non-periodic CAN messages and further accurately and effectively detect attack risks and attacks through the vehicle's internal network.

[0005] The background art of the present invention is disclosed in Korean Patent Publication No. 10-2023-0094513. Summary of the invention

[0006] In order to solve the above problems in the prior art, the purpose of the present invention is to provide an intrusion detection system construction device and method applied to controller local area network communication, which can set detection rules (Policy Rule) for detecting and processing controller local area network messages associated with the vehicle in a variety of ways.

[0007] However, the technical objectives to be achieved by the embodiments of the present invention are not limited to the above technical objectives, and other technical objectives may exist.

[0008] As a technical solution for achieving the above-mentioned technical objectives, a method for constructing an intrusion detection system applied to controller local area network communication according to an embodiment of the present invention may include the following steps: parsing an input file associated with controller local area network communication to extract standard information; using the extracted standard information and applying at least one of a fixed rule set and a custom rule set to set detection policy rules; and packaging the standard information and the detection policy rules to generate a policy file applied to the above-mentioned intrusion detection system.

[0009] Furthermore, the standard information may include at least one of electronic control unit (ECU) information, protocol data unit (PDU) information, message information, signal information and bus (BUS) information.

[0010] Furthermore, the detection strategy rule may include at least one of a first detection strategy related to the bus information, a second detection strategy related to the message information, and a third detection strategy associated with the signal information.

[0011] Furthermore, in the above step of setting the detection strategy rules, at least a portion of the predefined multiple parameters may be set as the above fixed rule set.

[0012] Furthermore, the above step of setting the detection strategy rules may include the following steps: defining applicable custom parameters as the above custom rule set; and determining at least one of a combination and a set value of the above custom parameters.

[0013] Furthermore, the above-mentioned policy file may include a binary file.

[0014] Furthermore, the binary file may be generated as a hierarchical structure including policy header information, display lookup table information, and policy body information.

[0015] Furthermore, the above-mentioned policy file may be applied to at least one of the core layer and the detection layer of the above-mentioned intrusion detection system.

[0016] Furthermore, the input file may include a controller area network database (CAN DBC) file.

[0017] On the other hand, an intrusion detection system construction device applied to controller local area network communication according to an embodiment of the present invention may include: an input file analysis unit, which extracts standard information by parsing an input file associated with the controller local area network communication; a policy setting unit, which uses the extracted standard information and applies at least one of a fixed rule set and a custom rule set to set detection policy rules; and a policy file generation unit, which generates a policy file applied to the above-mentioned intrusion detection system by packaging the above-mentioned standard information and the above-mentioned detection policy rules.

[0018] Furthermore, the policy setting unit may set at least a portion of a plurality of predefined parameters as the fixed rule set.

[0019] Furthermore, the policy setting unit may define applicable custom parameters as the custom rule set, and determine at least one of a combination and a setting value of the custom parameters.

[0020] The above technical solutions are only examples and should not be interpreted as limiting the meaning of the present invention. In addition to the above exemplary embodiments, there may be additional embodiments in the drawings and detailed description.

[0021] Effects of the Invention

[0022] According to the technical solution described above, the intrusion detection system construction device and method applied to controller area network communication of the present invention can set detection rules (Policy Rule) for detecting and processing controller area network messages associated with the vehicle in a variety of ways.

[0023] However, the effects that can be obtained by the present invention are not limited to the above effects, and other effects may exist. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 and Figure 2 A simplified structural diagram of an intrusion detection system according to an embodiment of the present invention.

[0025] Figure 3 The conceptual diagram is used to illustrate the workflow of an intrusion detection system construction device applied to controller area network communication according to an embodiment of the present invention.

[0026] Figure 4a and Figure 4b This is an example diagram of the parameter types for a static ruleset.

[0027] Figure 5a to Figure 5c These are illustrative diagrams of collectible parameters for the first to third detection strategies, respectively.

[0028] Figure 6 A conceptual diagram for explaining the types of detection rule combinations that can be set by a user.

[0029] Figure 7 This is an example diagram of the collectable parameters of a custom ruleset.

[0030] Figure 8 The diagram is an example of a hierarchical structure of a policy file generated by an intrusion detection system construction device applied to controller area network communication according to an embodiment of the present invention.

[0031] Fig. 9 The figure shows the data structure of the policy header information of a binary file.

[0032] Fig.10 is a diagram showing the data structure of the bus detection rule flag.

[0033] Fig.11 A diagram showing a data structure showing lookup table information for a binary file.

[0034] Fig.12 A simplified structural diagram of an intrusion detection system construction device applied to controller area network communication according to an embodiment of the present invention.

[0035] Fig.13 The present invention is a flowchart of a method for constructing an intrusion detection system for controller area network communication according to an embodiment of the present invention.

[0036] Description of Reference Numerals

[0037] 10: Intrusion Detection System

[0038] 11: First floor

[0039] 12: Second layer

[0040] 13: The third floor

[0041] 14: Controller

[0042] 100: Device for constructing an intrusion detection system for controller area network communication

[0043] 110: Input file analysis department

[0044] 120: Strategy Setting Department

[0045] 130: Policy file generation unit

[0046] 1: Input file

[0047] 2: Policy File DETAILED DESCRIPTION

[0048] Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art can easily implement the present invention. However, the present invention can be implemented in a variety of different embodiments and is not limited to the embodiments described herein. Moreover, in order to clearly describe the present invention with reference to the accompanying drawings, parts not related to the description will be omitted, and similar parts will be given similar reference numerals throughout the entire text of the specification.

[0049] Throughout the present specification, when it is said that a certain part is “connected” to another part, it not only means the case of “direct connection” but also includes the case of “electrical connection” or “indirect connection” with other elements in between.

[0050] Throughout the entire text of this specification, when a component is expressed as being "on", "upper part", "upper end", "lower", "lower part" or "lower end" of another component, it not only indicates the situation that the component is in contact with another component, but also includes the situation where there are other components between the two components.

[0051] Throughout the present specification, when a part is expressed to “comprise” another structural element, unless there is a special description to the contrary, it means that the other structural elements are also included, rather than excluded.

[0052] The invention relates to an intrusion detection system construction device and method applied to controller local area network communication.

[0053] Figure 1 and Figure 2 FIG. 1 is a simplified structural diagram of an intrusion detection system according to an embodiment of the present invention. Specifically, Figure 1 The following is a structural diagram showing the application of CAN-IDS in a general ECU system.

[0054] Reference Figure 1 The intrusion detection system 10 of one embodiment of the present invention may be composed of a layered structure including a first layer 11, a second layer 12 and a third layer 13. Figure 2 , the intrusion detection system 10 according to an embodiment of the present invention may include a controller 14 .

[0055] Specifically, according to an embodiment of the present invention, the first layer 11 of the intrusion detection system 10 may include a detection layer (IDS Detect Layer). Also, the second layer 12 of the intrusion detection system 10 may include a core layer (IDS Core Layer).

[0056] In this regard, an intrusion detection system construction device 100 (hereinafter referred to as "intrusion detection system construction device 100") applied to controller local area network communication according to an embodiment of the present invention defines a detection policy rule (Policy Rule) 1000 applied to at least one of the detection layer (IDS Detect Layer) and the core layer (IDS Core Layer) of the intrusion detection system 10, and can generate a policy file 2 including the defined detection policy rule through operation.

[0057] In other words, the detection layer (IDS Detect Layer) and the core layer (IDS Core Layer) of the intrusion detection system 10 refer to the layers that perform the following functions, namely, detecting and processing the controller area network message based on the detection policy rule (Policy Rule) 1000 described in detail below.

[0058] On the other hand, referring to Figure 2 As an example, when the intrusion detection system 10 adopts a system structure based on the Classic AUTOSAR platform, the intrusion detection system 10 can be configured with a controller area network data packet monitoring system (CAN Packet Mirroring System) included in the protocol data unit routing (PduR) of the communication service layer (Communication Services Layer) of the basic software (BSW, Basic Software) or included in the complex driver (Complex Drivers).

[0059] For reference, in the relevant description of the embodiment of the present invention, the intrusion detection system construction device 100 defines the detection policy rules applied by the intrusion detection system 10, and is loaded in the form of a policy manager program (Policy Manager Program) on a vehicle (not shown) equipped with the intrusion detection system 10 in order to generate a policy file 2 reflecting the corresponding detection policy rules, but is not limited to this.

[0060] Figure 3 The conceptual diagram is used to illustrate the workflow of an intrusion detection system construction device applied to controller area network communication according to an embodiment of the present invention.

[0061] Reference Figure 3 The intrusion detection system construction device 100 can extract standard information by parsing the input file 1 associated with the CAN communication. Specifically, the input file 1 provided by the intrusion detection system construction device 100 can be a CAN database file, but is not limited thereto.

[0062] Specifically, the intrusion detection system construction device 100 can obtain standard information based on the input file 1 (refer to Figure 3 In the above-mentioned standard information, the standard information includes at least one of electronic control unit information, protocol data unit information, message information, signal information and bus information. On the other hand, the message information can also be called frame information.

[0063] Furthermore, the intrusion detection system construction device 100 can utilize the extracted standard information and apply a fixed rule set (refer to Figure 3 "b") and custom rule sets (see Figure 3'c') to set detection strategy rule 1000.

[0064] Specifically, the intrusion detection system construction device 100 can set the detection strategy rule 1000 in the standard information, and the above detection strategy rule 1000 includes at least one of a first detection strategy related to bus information, a second detection strategy related to message information, and a third detection strategy associated with signal information.

[0065] In this regard, the detection strategy rule 1000 disclosed in the present invention works like the basic detection engine (Detection Engine Base) of the intrusion detection system 10. The detection strategy rule 1000 may include bus detection rules, message detection rules, signal detection rules, periodic detection rules, etc. Each detection rule is independent and can determine whether to work based on the setting of the detection strategy.

[0066] Furthermore, the intrusion detection system construction device 100 can store the relevant contents of the defined detection policy rule 1000 as a policy file 2 of a binary file (Policy Binary) type as an IDS policy rule (Policy Rule) file. Furthermore, the detection policy rule 1000 can assign a buffering table (Buffering Table) and a policy rule to each message according to the policy rule of the binary file (Policy Binary).

[0067] Furthermore, according to an embodiment of the present invention, the intrusion detection system construction device 100 may set at least a portion of the predefined multiple parameters as a static rule set. In this regard, a static rule set refers to a set of preset (set) detection rules.

[0068] Figure 4a and Figure 4b This is an example diagram of the parameter types for a static ruleset.

[0069] Reference Figure 4a and Figure 4b The intrusion detection system construction device 100 can use the DBC information extracted as standard information to distinguish and generate a first detection strategy related to bus information, a second detection strategy related to message information, and a third detection strategy associated with signal information.

[0070] Figure 5a to Figure 5c The following are example diagrams of collectible parameters for the first detection strategy to the third detection strategy. Specifically, Figure 5a 1 is a diagram showing nine preset parameters that can be set for the first detection strategy related to bus information, Figure 5b4 is a diagram showing four preset parameters that can be set for the second detection strategy related to message information, Figure 5c FIG. 4 is a chart showing seven preset parameters that can be set for the third detection strategy related to signal information.

[0071] Reference Figure 5a to Figure 5c The various parameters applied by the detection policy rule 1000 can be distinguished from each other by the policy name (RuleName) and the policy identifier (Rule ID, Detection ID).

[0072] Illustratively, refer to Figure 5a , the first detection strategy may set parameters including: "Bus Load Too High" (identity identifier (ID) 1) for detecting the situation where the bus traffic (mps) is above the reference value (upper limit); "Bus Load Too Low" (identity identifier (ID) 2) for detecting the situation where the bus traffic is below the reference value (lower limit); "Unknown Arb ID (Arbitration)" (identity identifier (ID) 3) for detecting DBC undefined messages; "Signal Correlation Error" (identity identifier (ID) 4) for detecting abnormalities in relay gateway (Gateway Relay) messages; "Receive Unknown Electronic Control Unit Message (Recv Unknown ECU Message)" (identity identifier (ID) 5) for detecting messages received from unidentified (unknown) electronic control units; "Detected Dos Attack" (identity identifier (ID) 6) for detecting denial of service attacks; "Unknown Diagnostic ID (Unknown DIAG “DIAG Message Flooding” (Identifier (ID) : 8)”; and “DIAG Scanning Detected” (Identifier (ID) : 9)”, which is used to detect controller scanning attacks that utilize diagnostic messages.

[0073] Similarly, Figure 5b and Figure 5c Also shown are the policy name (Rule Name), policy identity identifier (Rule ID; Detection ID), and purpose / content (Description) of the second detection policy configurable parameter and the third detection policy configurable parameter.

[0074] Furthermore, according to one embodiment of the present invention, for the first detection strategy, the intrusion detection system construction device 100 can set the bus detection rule (first detection strategy) as the detection rule flag (Detection Rule flag) of the policy header (Policy Header) information of the policy file 2. In the IDS engine, work is performed according to the setting of the detection rule flag of the policy header. If an abnormal detection message occurs, the policy identity identifier (RuleID; Detection ID) value corresponding to each parameter of the bus detection strategy is stored in the detection log buffer (DetectionLog Buffer) of the logging system (Logging System).

[0075] Moreover, according to one embodiment of the present invention, for the second detection strategy, the intrusion detection system construction device 100 can set the message detection rule (second detection strategy) in the detection rule flag (Detection rule flag) of the message header (Message Header). In the IDS engine, it can work according to the setting of the detection rule flag of the message header. If an abnormal detection message occurs, the policy identity identifier (Rule ID; Detection ID) value corresponding to each parameter of the message detection strategy will be stored in the detection log buffer (Detection LogBuffer) of the logging system (Logging System).

[0076] Moreover, according to one embodiment of the present invention, for the third detection strategy, the intrusion detection system construction device 100 can set the signal detection rule (third detection strategy) in the signal type (Signal Type) of the signal header (Signal Header). In the IDS engine, it can work according to the signal type setting of the signal header. If an abnormal detection message occurs, the policy identity identifier (Rule ID; Detection ID) value corresponding to each parameter of the signal detection strategy will be stored in the detection log buffer (Detection Log Buffer) of the logging system (Logging System).

[0077] Furthermore, according to another embodiment of the present invention, the setting unit 120 may define the applicable custom parameters as a custom rule set. Furthermore, the intrusion detection system construction device 100 may determine at least one of the combination and setting value of the custom parameters. In this regard, a custom rule set refers to a detection rule set whose content can be determined by a user.

[0078] In particular, in the case of a custom rule set, the intrusion detection system 10 may set a detection policy based on sensor information of a signal of a received CAN message.

[0079] Figure 6 A conceptual diagram for explaining the types of detection rule combinations that can be set by a user.

[0080] Reference Figure 6 , can be obtained through Figure 6 The multiple ways shown determine the detection combinations that users can set using custom rule sets. Specifically, Figure 6 (a) in the example is a detection rule combination that omits the argument value and performs detection only on signal types such as counting and CRC. Figure 6 (b) is a combination of detection rules based on a fixed set of detection arguments such as Enum and Range Detection. Figure 6 (c) in the figure is a combination of detection rules based on a single user-defined conditional rule set. Figure 6 (d) is a combination of multiple user-defined conditional detection rules based on a custom rule set. Figure 6 (e) in the figure is a composite detection rule combination that applies both a fixed rule set and a custom rule set.

[0081] On the other hand, for Figure 6 In the multi-user defined conditional formula shown in (d), for example, when the first condition (expression 1), the second condition (expression 2), and the third condition (expression 3) are all met, various logical combinations such as the detection implementation setting (the first condition, the second condition, and the third condition (expression 1 AND expression 2 AND expression 3))) can be applied to the multi-user defined conditions.

[0082] Figure 7 This is an example diagram of the collectable parameters of a custom ruleset.

[0083] Reference Figure 7In order to reflect the various conditions and scenarios that can be controlled by utilizing the various sensing information and measurement information obtained by the vehicle (not shown) to which the intrusion detection system 10 is applied, a variety of custom parameters can be defined according to user settings, for example, parameters for detecting the rotation of the wheels when the shift lever is in the P gear, parameters for detecting an abnormal increase in the speed difference of each wheel, parameters for detecting the vehicle is running or the battery voltage is abnormally low, parameters for detecting the abnormal condition of the heat wire and the vent plate being opened at the same time, etc.

[0084] Furthermore, the intrusion detection system construction device 100 can generate a policy file applied to the intrusion detection system 10 by packaging standard information and detection policy rules.

[0085] In other words, the intrusion detection system construction device 100 can use the parsed DBC information to set the detection policy rule 1000 based on at least one of the fixed rule set and the custom rule set, and can generate the policy file 2 in the form of a binary file by packaging and combining the generated information (DBC information and detection policy rule information).

[0086] Below, refer to Figures 8 to 11 The data structure of the policy file 2 generated by the intrusion detection system construction device 100 will be described in detail.

[0087] Figure 8 The diagram is an example of a hierarchical structure of a policy file generated by an intrusion detection system construction device applied to controller area network communication according to an embodiment of the present invention.

[0088] Reference Figure 8 The intrusion detection system construction device 100 can generate a binary file as a policy file 2, and the binary file has a hierarchical structure including policy header information 21, display lookup table information 22 and policy body information 23. In particular, the policy body information 23 may include information of the detection policy rules 1000 of each controller area network application.

[0089] Fig. 9 The figure shows the data structure of the policy header information of a binary file.

[0090] Reference Fig. 9The policy header information 21 is located at the beginning of the policy file 2, and may be composed of a policy version, a generation date, a detection setting applied to the controller local area network, etc. According to an embodiment of the present invention, the policy header information 21 may comprehensively set a policy for preset multiple (e.g., 6, etc.) bus information, and may reflect the detection policy rules generated based on the bus information extracted from the DBC. For example, the size of the policy header information 21 may be 48 bytes, and may include the following data fields.

[0091] First, the policy version (88 bytes) is a data field representing the version information of the binary file, for example, it may include vehicle type information (vehicle type; 2 bytes), major version information (major version; 2 bytes), minor version information (minor version; 2 bytes), detailed version information (detail version; 2 bytes), etc.

[0092] Furthermore, the created timestamp (48 bytes) is a data field indicating the date (time) information of the binary file creation, and for example, a notation of 1900-01-01.00:00:00 to 2037-12-31.23:59:59 can be applied.

[0093] In addition, it may additionally include a bus count (2 bytes) data field indicating the number of buses, a message count (message count) data field indicating the number of messages, a buf-5-rec-num (2 bytes) data field indicating that the number of buffers for controller area network standard messages is 5, an fd-buf-10-rec-num (2 bytes) data field indicating that the number of buffers for controller area network FD messages is 10, and the like.

[0094] In addition, when setting policy rules for multiple preset controller area network bus information, a bus number (1 byte) data field representing the controller area network bus number, a detection rule flag (1 byte) data field representing the detection rule setting applied to the bus, etc. can be applied.

[0095] Relatedly, Fig.10 is a diagram showing the data structure of the bus detection rule flag.

[0096] Reference Fig.10The bus detection rule flag may include a "Bus detect ON / OFF" field, which is used to determine whether to apply all detection rules to the bus itself. When the corresponding field is 0, all detection objects are excluded, and the detection rules can be applied only when there is only one person.

[0097] In addition, the bus detection rule flag may include: an "Unknown Arbitration ID detect" field, which is used to detect a situation where a message with an arbitration ID that does not exist in the detection strategy flows into the bus; a "Bus load detect" field, which is used to detect a situation where the bus load is out of an appropriate range; an "Invalid DIAG detect" field, which is used to detect an invalid diagnostic message flowing into the bus; a "Denial of Service Attack Detect" field, which is used to detect a Denial of Service attack (DoS) on the bus; an "Unknown Diagnostic ID Detect" field, which is used to detect a diagnostic message that does not exist in the DBC; a "Diagnostic Flood Detect" field, which is used to detect a controller service attack using a diagnostic message; and a "Diagnostic Scan Detect" field, which is used to detect a controller scan attack using a diagnostic message.

[0098] For reference, in the case of the "Bus load detect" field, additional settings for the minimum load value / maximum load value may be required. In this regard, the value for setting the maximum load of the bus is defined as the maximum load (mps) (maximum load mps) (1 byte) field, and the value for setting the minimum load of the bus can be defined as the minimum load (mps) (minimum load mps) (1 byte) field. For example, the maximum load setting value and the minimum load setting value are in the form of mps (messages for second) values, which can be set within a range of 0 mps to 25500 mps at a scale of 1 / 100, but are not limited thereto.

[0099] In addition, the above-mentioned bus detection rules can be set by the intrusion detection system construction device 100, and the work in the IDS engine of the intrusion detection system 10 can be changed according to the value of the detection rule setting flag. When an abnormality occurs in the detection, the detection identity identifier (Detection ID) value of the bus detection parameter (Parameter) can be stored in the log buffer (Log Buffer).

[0100] Fig.11 A diagram showing a data structure showing lookup table information for a binary file.

[0101] Reference Fig.11 , the display lookup table information 22 may include information for storing and searching the set detection strategy rule 1000 and the data of the received message in a buffer.

[0102] Specifically, the display lookup table information 22 stores items (contents) of the controller area network information extracted from the DBC. In this case, a lookup key can be generated by a combination of a controller area network bus (CAN BUS) + an arbitration identifier (ArbitrationID) (controller area network identifier). The policy body information 23 and the buffering table information of the detection strategy for the controller area network message can be stored. To this end, illustratively, the display lookup table information 22 can be designed as a 6-byte data structure, which can be generated according to the total number of messages of the DBC.

[0103] On the other hand, the description shows that each data field of the lookup table information 22, as the keyword (Key) used to search the policy body (Policy Body) and the buffering table (Buffering Table) for the detection policy rule, the "lookup key (lookup key) (2 bytes)" field is the controller area network bus identity identifier (CAN BUS ID), which can be composed of the "bus identity identifier (bUS ID) (5 bits)" field representing the bus identity identifier (BUS ID) stored in the policy header (Policy Header) and the "arbitration identity identifier (Arbitration ID) (11 bits)" representing the controller area network message identity identifier, and may include: "policy index (policy index) (2 bytes)" field, representing the index (index) information of the detection policy rule of the policy body information 23; "entry index (entry index) (2 bytes)" field, representing the index information of the buffering table.

[0104] Furthermore, the entry index field may be composed of a "buffer type (2 bits)" field and a "buffer index (14 bytes)" field, wherein the "buffer type (2 bits)" field indicates information for storing controller local area network messages in the buffer table, and the "buffer index (14 bits)" field indicates address information of the buffer table.

[0105] In summary, the following work may be performed, that is, storing the CAN message received through the policy index information and the entry index information of the policy subject information 23 in the buffering table.

[0106] More specifically, if a CAN message is received, the CAN message is stored in the buffering table by looking up the key (BUS+arbitration ID) and based on the buffer type and index information of the display lookup table. The CAN messages are divided into Standard and FD, and the buffering table has a storage space for all CAN messages of the display lookup table, and the storage location varies according to the message type. During the initialization process, the buffering table is allocated in the RAM area (fixed address area) of the fixed image. If a CAN message is received, it is determined whether to put it into a table set to 5 buffers or a table set to 10 buffers by the buffer type of the CAN message equivalent to the display lookup table. If the received message is a CAN standard message and the buffer type is 00, it is stored at the address corresponding to the buffer index number of the buf-5-rec-num table. Furthermore, the first item of the Lookup Table is an item for detecting a message not registered in the DBC. The corresponding item is designated as an item required for buffering and is allocated in the Buffering Table.

[0107] Furthermore, if the CAN message is stored in the buffering table, the detection policy rule of the CAN message of the policy body is searched through the information of the policy index. Whether the CAN message is valid data can be determined through the searched information.

[0108] The policy subject information 23 may include a detection policy rule (PolicyRule) of each CAN message. In order to set the detection policy rule of each CAN message, it may be composed of a "Message Header" field and a "Signal Policy Rule" field.

[0109] Specifically, the policy subject information 23 can use the message header field as a controller area network standard (CANStandard) and controller area network FD share. Based on the information obtained from the DBC, the attribute values ​​related to the detection policy rule (normal cycle, upper / lower limit range, detection rule use flag) are added, and the data structure of the message header field can be 5 bytes, as shown below.

[0110] Specifically, the message header field may include: a controller area network FD (1 bit) field, which is determined to be 0 in the case of a controller area network standard message (CAN Standard Message) and is determined to be 1 in the case of a controller area network FD; a periodic (1 bit) field, which is determined to be 1 if the controller area network message (CAN Message) is periodic; an event (1 bit) field, which is determined to be 1 if the controller area network message is an event; a reverse (1 bit) field, which indicates an error condition in which the message flows in the opposite direction; a DLC (4 bits) field, which indicates the data length of the controller area network message; an average period (Average period) (1 byte) field (which can be set to a maximum of 0ms to 2550ms in units of 10ms at a ratio of 1 / 10), which indicates the average period of the message; a signal count (Signal count) (6 bits) field, which indicates the number of signals included in the message; an upper period margin (Upper period margin) margin) (5 bits) field (can be set to a maximum of 32ms in 1ms units), which indicates the upper limit correction value required for judgment based on the average period; the lower period margin (Lower Period margin) (5 bits) field (can be set to a maximum of 32ms in 1ms units), which indicates the lower limit correction value required for judgment based on the average period; the detection rule flag (Detection rule flag) (4 bits) field, which indicates DLC anomaly detection activation, period detection activation, etc.; the message body size (Message body size) (12 bits) field (maximum 4095 bytes), which indicates the size of the signal policy rule (Signal Policy Rule) after the message header.

[0111] Furthermore, the signal strategy rule field may include a signal header storing basic signal information such as bit position, length, symbol, byte order, and signal type. In this case, the type to be searched may be determined based on DBC derivation or analysis of data dumps.

[0112] On the other hand, the signal header is shared by the controller area network standard (CAN Standard) and the controller area network FD. In the maximum 64 bytes, the initial position of the signal (Signal) is 0 to 511, and the maximum signal (Signal) size shall not exceed 128 bits (16 bytes). Specifically, the data structure of the signal header (Signal Header) may include a bit index (bit index) (9 bits) field of 0 to 512, a length (length) (7 bits) field of 0 to 127, an order (order) (1 bit) field, a sign (sign) (1 bit) field, a signal type (signal type) (6 bits) field of 0 to 63, a signal body size (signal body size) (1 byte) field of 0 to 255, etc.

[0113] Furthermore, in relation to the signal type, "enum (0×00)" is an enumeration type signal having multiple values ​​and having restriction characteristics (for example, 0: inactive, 1: on, 2: off, 3: invalid, etc.), "counter (0×01)" is a counting mode signal whose value changes sequentially and increases, "CRC (0×02)" is a signal required for CRC calculation, and it is necessary to obtain the bit range used for CRC calculation, "constant (const) (0×03)" is a signal used to represent an unused bit area, and has the characteristic of having no additional information in the actual DBC, "sensor (sensor) (0×04)" is a signal having an ordinary irregular sensor value and having a value range, and "binary (binary) (0×05)" is a signal with a length of 1 bit, which refers to a signal represented by 0 or 1.

[0114] In addition, the detection argument is located after the signal header, including parameter value information for the detection rule. Various parameter values ​​can be obtained according to the type of detection rule, and can be designed to be smoothly implemented using parameter codes. The detection argument consists of a detection header and a detection body. The detection header can predetermine the type and type of the argument value based on the combination of the argument code and the sub code.

[0115] Specifically, the various data fields of the detection parameters may include an "argument code (5 bits)" field, a "sub code (3 bits)" field, a "argument body size (1 byte)" field, a "argument body (2 bytes)" field, and the like.

[0116] Fig.12 A simplified structural diagram of an intrusion detection system construction device applied to controller area network communication according to an embodiment of the present invention.

[0117] Reference Fig.12 , the construction device 100 may include an input file analysis unit 110 , a policy setting unit 120 and a policy file generation unit 130 .

[0118] The input file analysis unit 110 may extract standard information by parsing an input file associated with the CAN communication.

[0119] Specifically, the input file analysis unit 110 may obtain standard information from the input file 1 , where the standard information includes at least one of electronic control unit information, protocol data unit information, message information, signal information, and bus information.

[0120] The policy setting unit 120 may use the extracted standard information to apply at least one of a fixed rule set and a custom rule set to set the detection policy rule.

[0121] Specifically, the strategy setting unit 120 may set detection strategy rules in the standard information, wherein the detection strategy rules include at least one of a first detection strategy related to bus information, a second detection strategy related to message information, and a third detection strategy associated with signal information.

[0122] In this regard, according to an embodiment of the present invention, the policy setting unit 120 may set at least a portion of the predefined multiple parameters as a fixed rule set.

[0123] Furthermore, according to yet another embodiment of the present invention, the policy setting unit 120 may define applicable custom parameters as a custom rule set. Furthermore, the policy setting unit 120 may determine at least one of a combination and a setting value of the custom parameters.

[0124] The policy file generation unit 130 may generate a policy file applied to the intrusion detection system 10 by packaging standard information and detection policy rules.

[0125] Specifically, the policy file generation unit 130 may generate a binary file into a policy file, where the binary file is a hierarchical structure including policy header information, display lookup table information, and policy body information.

[0126] The following briefly describes the workflow of the present invention based on the above detailed description.

[0127] Fig.13 The present invention is a flowchart of a method for constructing an intrusion detection system for controller area network communication according to an embodiment of the present invention.

[0128] Fig.13 The intrusion detection system construction method for CAN communication can be executed by the construction device 100 described above. Therefore, even if the following content is omitted, the intrusion detection system construction method for CAN communication can also be applied to the description of the construction device 100.

[0129] Reference Fig.13 In step S11, the input file analysis unit 110 may extract standard information by parsing the input file 1 associated with the CAN communication.

[0130] Specifically, in step S11 , the input file analysis unit 110 may obtain standard information from the input file 1 , where the standard information includes at least one of electronic control unit information, protocol data unit information, message information, signal information, and bus information.

[0131] Next, in step S12 , the policy setting unit 120 may use the extracted standard information to apply at least one of a fixed rule set and a custom rule set to set the detection policy rules.

[0132] Specifically, in step S12, the strategy setting unit 120 may set detection strategy rules in the standard information, wherein the detection strategy rules include at least one of a first detection strategy related to bus information, a second detection strategy related to message information, and a third detection strategy associated with signal information.

[0133] According to an embodiment of the present invention, in step S12 , the policy setting unit 120 may set at least a portion of the predefined plurality of parameters as a fixed rule set.

[0134] According to another embodiment of the present invention, in step S12, the policy setting unit 120 may define applicable custom parameters as a custom rule set. Also, in step S12, the policy setting unit 120 may determine at least one of a combination and a setting value of the custom parameters.

[0135] Then, in step S13 , the policy file generation unit 130 may generate a policy file applied to the intrusion detection system 10 by packaging the standard information and the detection policy rules.

[0136] Specifically, in step S13 , the policy file generation unit 130 may generate a binary file into a policy file, where the binary file is a hierarchical structure including policy header information, display lookup table information, and policy body information.

[0137] In the above description, steps S11 to S13 can be divided into additional steps or composed of smaller steps according to the implementation examples of the present invention. In addition, some steps can be omitted according to needs, and the order of the steps can also be changed.

[0138] According to an embodiment of the present invention, the intrusion detection system construction method applied to the controller local area network communication can be implemented by executable program instructions of various computer devices and recorded in a computer-readable medium. The above-mentioned computer-readable medium may include program instructions, data files, data structures, etc. alone or in combination. The program instructions recorded in the above-mentioned medium may be specially designed for the embodiment, or may be known and available to ordinary technicians in the field of computer software. For example, the computer-readable recording medium may include magnetic media (magnetic media) such as hard disks, floppy disks and magnetic disks, optical recording media (optical media) such as CD-ROMs and DVDs, magneto-optical media (magneto-optical medium) such as optical magnetic floppy disks (floptical disks), and read-only memory (ROM), random access memory (RAM), flash memory, etc., which are dedicated hardware devices for storing and executing program instruction languages. In addition to the machine language code written by the compiler, the program instructions include high-level language codes that can be executed by a computer using an interpreter. In order to perform the work of the present invention, the above-mentioned hardware device can be used as more than one software module to work, and vice versa.

[0139] Furthermore, the above-mentioned intrusion detection system construction method applied to controller area network communication can also be implemented in the form of a computer program or application program stored in a recording medium and executed by a computer.

[0140] The above description of the present invention is only for illustrative purposes, but it should be understood that, without departing from the technical concept of the present invention or changing the essential features, a person skilled in the art of the present invention can easily modify the present invention through other specific implementations. Therefore, the embodiments described above are only examples at all levels and should not be understood as limiting the meaning. For example, each structural element described as a single type can be implemented in a dispersed manner, and similarly, the structural elements described as dispersed can also be implemented in a combined form.

[0141] Compared with the above detailed description, the scope of the present invention should be limited based on the scope of protection claimed in the invention, and all changes or modified embodiments derived from the meaning, scope and equivalent concepts of the scope of protection claimed in the invention belong to the scope of the present invention.

Claims

1. A method for constructing an intrusion detection system for controller area network communication, characterized in that: The method for constructing an intrusion detection system applied to controller area network communication comprises the following steps: parsing input files associated with controller area network communications to extract standard information; Using the extracted standard information and applying at least one of a fixed rule set and a custom rule set to set a detection policy rule; and The standard information and the detection policy rules are packaged to generate a policy file applied to the intrusion detection system.

2. The method for constructing an intrusion detection system for controller area network communication according to claim 1, characterized in that: The standard information includes at least one of electronic control unit information, protocol data unit information, message information, signal information and bus information.

3. The method for constructing an intrusion detection system for controller area network communication according to claim 2, characterized in that: The detection policy rule includes at least one of a first detection policy related to the bus information, a second detection policy related to the message information, and a third detection policy associated with the signal information.

4. The method for constructing an intrusion detection system for controller area network communication according to claim 3, characterized in that: In the step of setting the detection strategy rules, at least a portion of a plurality of predefined parameters is set as the fixed rule set.

5. The method for constructing an intrusion detection system for controller area network communication according to claim 3, characterized in that: The steps of setting the detection strategy rules include the following steps: defining applicable custom parameters as the custom rule set; and At least one of a combination and a setting value of the custom parameter is determined.

6. The method for constructing an intrusion detection system for controller area network communication according to claim 1, characterized in that: The policy file is a binary file.

7. The method for constructing an intrusion detection system for controller area network communication according to claim 6, characterized in that: The binary file is generated as a hierarchical structure including policy header information, display lookup table information and policy body information.

8. The method for constructing an intrusion detection system for controller area network communication according to claim 1, characterized in that: The policy file is applied to at least one of a core layer and a detection layer of the intrusion detection system.

9. The method for constructing an intrusion detection system for controller area network communication according to claim 1, characterized in that: The input files include a controller area network database file.

10. An intrusion detection system construction device applied to controller area network communication, characterized in that: The intrusion detection system construction device applied to controller local area network communication includes: an input file analysis unit, for extracting standard information by parsing an input file associated with controller area network communications; a policy setting unit, using the extracted standard information and applying at least one of a fixed rule set and a custom rule set to set a detection policy rule; and The policy file generating unit generates a policy file applied to the intrusion detection system by packaging the standard information and the detection policy rules.

11. The intrusion detection system construction device for controller area network communication according to claim 10, characterized in that: The standard information includes at least one of electronic control unit information, protocol data unit information, message information, signal information and bus information.

12. The intrusion detection system construction device for controller area network communication according to claim 11, characterized in that: The detection policy rule includes at least one of a first detection policy related to the bus information, a second detection policy related to the message information, and a third detection policy associated with the signal information.

13. The intrusion detection system construction device for controller area network communication according to claim 12, characterized in that: The policy setting unit sets at least a part of a plurality of predefined parameters as the fixed rule set.

14. The intrusion detection system construction device for controller area network communication according to claim 12, characterized in that: The policy setting unit defines applicable custom parameters as the custom rule set, and determines at least one of a combination and a setting value of the custom parameters.

15. The intrusion detection system construction device for controller area network communication according to claim 10, characterized in that: The policy file is a binary file, and the binary file is generated as a hierarchical structure including policy header information, display lookup table information and policy body information.

Images