Method and apparatus for identifying function for each id of vehicle communication protocol

Abstract

Disclosed is a method for identifying a function for each ID of a vehicle communication protocol, which is performed by an electronic device. The present method for identifying a function for each ID comprises the steps of: classifying collected vehicle communication protocol data by ID; generating an ID-specific signal on the basis of the vehicle communication protocol data classified by ID; extracting an ID-specific feature on the basis of the vehicle communication protocol data classified by ID and the ID-specific signal; and on the basis of the extracted ID-specific feature, predicting functions respectively corresponding to IDs included in the vehicle communication protocol data.

Description

Method and device for identifying functions by ID of vehicle communication protocol

[0001] The present invention relates to an electronic device and a method for identifying functions by ID of a vehicle communication protocol performed by the electronic device.

[0002] Most cybersecurity issues in vehicles stem from exploiting vehicle communication protocols such as the Controller Area Network (CAN) or CAN with Flexible Data Rate (CAN-FD). To properly defend against cyberattacks on vehicles, it's necessary to understand the functions that correspond to the IDs included in vehicle communication protocol messages.

[0003] However, the functions of each ID in the vehicle communication protocol are not standardized due to security issues, etc., and which ID is responsible for which function of the vehicle may vary depending on the vehicle manufacturer or even within the same manufacturer depending on the vehicle model or model year.

[0004] Due to the nature of these vehicle communication protocols, it's difficult to identify which functions each ID in the target vehicle is responsible for, which limits the analysis of vehicle communication protocol data. For example, even if a vehicle executes only the desired function to collect data for a specific function, the collected data will include not only data for the ID responsible for the desired function, but also data generated by the vehicle either routinely or periodically. In other words, the collected data will include data from various IDs other than the target ID, making it difficult to analyze data for the specific function being analyzed.

[0005] Meanwhile, a public database exists that analyzes the functions assigned to vehicle communication protocol IDs. However, this database only contains information about specific vehicles and does not cover all vehicle function-specific IDs. Furthermore, in some cases, the analyzed data contains incorrect information that differs from the actual function assigned to the vehicle communication protocol ID.

[0006] In addition, the existing vehicle communication protocol ID analysis by function was performed in a heuristic manner, which was time-consuming and sometimes resulted in analysis with incorrect information.

[0007] The purpose of the present invention is to provide an electronic device capable of automatically predicting functions by ID of a vehicle communication protocol and a control method thereof.

[0008] According to one embodiment of the present invention, a method for identifying functions by ID of a vehicle communication protocol performed by an electronic device may include a step of classifying collected vehicle communication protocol data by ID, a step of generating a signal by ID based on the vehicle communication protocol data classified by ID, a step of extracting a feature by ID based on the vehicle communication protocol data classified by ID and the signal by ID, and a step of predicting functions corresponding to each ID included in the vehicle communication protocol data based on the extracted feature by ID.

[0009] Additionally, the vehicle communication protocol data may include at least one of CAN (Controller Area Network) and CAN-FD (CAN with Flexible Data rate).

[0010] Additionally, the vehicle communication protocol data may include at least one of vehicle communication protocol data generated from a vehicle in a stopped state and vehicle communication protocol data generated from a vehicle in a running state.

[0011] In addition, the step of generating the signal by ID may include a step of extracting the signal by ID in preset time interval units from the vehicle communication protocol data classified by ID.

[0012] Additionally, the ID-specific features may include at least one of a similarity distance between IDs, a bit flip rate per ID, and a bit histogram per ID.

[0013] In addition, the step of extracting features by ID may include a step of extracting at least one of a bit flip rate by ID and a bit histogram by ID from vehicle communication protocol data classified by ID, and a step of extracting a similarity distance between the IDs based on the signal by ID.

[0014] Additionally, the similarity distance between the IDs may include a dynamic time warping (DTW) distance between different ID signals.

[0015] Additionally, the step of predicting functions corresponding to each of the IDs may include a step of inputting the extracted ID-specific features into an artificial intelligence model trained to predict functions corresponding to the IDs.

[0016] Additionally, the artificial intelligence model may be a model learned based on vehicle communication protocol data collected from the same vehicle from which the vehicle communication protocol data is collected.

[0017] Additionally, the artificial intelligence model may be a model learned based on vehicle communication protocol data collected from a vehicle other than the vehicle from which the vehicle communication protocol data is collected.

[0018] Additionally, it may include a step of learning an artificial intelligence model based on the extracted ID-specific features.

[0019] In addition, the step of learning the artificial intelligence model learns the artificial intelligence model to predict a function corresponding to the ID based on the extracted ID-specific features and ID-specific function information, and the ID-specific function information can be obtained from a vehicle communication protocol database including information on a function corresponding to the ID.

[0020] Meanwhile, an electronic device according to an embodiment of the present invention may include a memory for storing collected vehicle communication protocol data, and a processor for classifying the collected vehicle communication protocol data by ID, generating an ID-specific signal based on the vehicle communication protocol data classified by ID, extracting an ID-specific feature based on the vehicle communication protocol data classified by ID and the ID-specific signal, and predicting functions corresponding to IDs included in the vehicle communication protocol data based on the extracted ID-specific feature.

[0021] Additionally, the processor can extract signals by ID in preset time interval units from vehicle communication protocol data classified by ID.

[0022] Additionally, the ID-specific features may include at least one of a similarity distance between IDs, a bit flip rate per ID, and a bit histogram per ID.

[0023] Additionally, the processor can extract at least one of a bit flip rate per ID and a bit histogram per ID from vehicle communication protocol data classified by ID, and extract a similarity distance between the IDs based on the signal per ID.

[0024] Additionally, the similarity distance between the IDs may include a dynamic time warping (DTW) distance between different ID signals.

[0025] In addition, the memory stores an artificial intelligence model learned to predict a function corresponding to an ID, and the processor can input the extracted ID-specific features into the artificial intelligence model to predict functions corresponding to each ID included in the vehicle communication protocol data.

[0026] Additionally, the processor can learn an artificial intelligence model based on the extracted ID-specific features.

[0027] Meanwhile, in accordance with an embodiment of the present invention, a non-transitory computer-readable recording medium storing a computer command that causes an electronic device to perform an operation when executed by a processor of the electronic device, the operation may include a step of classifying collected vehicle communication protocol data by ID, a step of generating an ID-specific signal based on the vehicle communication protocol data classified by ID, a step of extracting an ID-specific feature based on the vehicle communication protocol data classified by ID and the ID-specific signal, and a step of predicting functions corresponding to IDs included in the vehicle communication protocol data based on the extracted ID-specific feature.

[0028] According to the various embodiments of the present invention described above, the ID-specific functions of the vehicle communication protocol can be automatically predicted quickly and accurately.

[0029] FIG. 1 is a block diagram illustrating a CAN (Controller Area Network) communication system according to one embodiment of the present invention.

[0030] FIG. 2 is a drawing for explaining a CAN message format according to one embodiment of the present invention.

[0031] Figure 3 is a block diagram of an electronic device according to an embodiment of the present invention.

[0032] FIG. 4 is a drawing for explaining the configuration and operation of a processor according to one embodiment of the present invention.

[0033] FIG. 5 is a diagram for explaining learning data according to one embodiment of the present invention.

[0034] FIG. 6 is a diagram for explaining learning data according to one embodiment of the present invention.

[0035] Figure 7 is a block diagram of an electronic device according to an embodiment of the present invention.

[0036] Figure 8 is a flowchart illustrating an operating method of an electronic device according to an embodiment of the present invention.

[0037] FIG. 9 is a flowchart illustrating an operating method of an electronic device according to an embodiment of the present invention.

[0038] FIG. 10 is a flowchart illustrating an operating method of an electronic device according to an embodiment of the present invention.

[0039] It should be understood that the various embodiments of the present invention described below with reference to the drawings are not intended to limit the scope to specific embodiments, but rather include various modifications, equivalents, and / or alternatives. In connection with the description of the drawings, similar reference numerals may be used for similar components.

[0040] In describing the present invention, detailed descriptions of related known technologies will be omitted if they are deemed to unnecessarily obscure the gist of the present disclosure. Furthermore, redundant descriptions of identical components will be omitted as much as possible.

[0041] The suffix "부" used for components in the following description is given or used interchangeably only for the convenience of writing specifications, and does not have a distinct meaning or role in itself.

[0042] The terms used in this invention are used to describe embodiments and are not intended to limit or restrict the present invention. Singular expressions include plural expressions unless the context clearly indicates otherwise.

[0043] In the present invention, terms such as 'include' or 'have' are intended to specify the presence of a feature, number, step, operation, component, part or combination thereof described in the specification, but should be understood as not excluding in advance the possibility of the presence or addition of one or more other features, numbers, steps, operations, components, parts or combinations thereof.

[0044] When it is said that a component (e.g., a first component) is "(operatively or communicatively) coupled with / to" or "connected to" another component (e.g., a second component), it should be understood that said component is directly coupled to / to said other component, or may be connected via another component (e.g., a third component). Conversely, when it is said that a component (e.g., a first component) is "directly coupled to" or "directly connected to" another component (e.g., a second component), it should be understood that no other component (e.g., a third component) exists between said component and said other component.

[0045] Unless otherwise defined, terms used in the embodiments of the present invention may be interpreted as having meanings commonly known to a person of ordinary skill in the art.

[0046] Hereinafter, various embodiments of the present disclosure will be described in detail with reference to the attached drawings.

[0047] FIG. 1 is a block diagram illustrating a CAN (Controller Area Network) communication system according to one embodiment of the present invention.

[0048] Referring to FIG. 1, a CAN communication system (10) may include a CAN bus (15) for transmitting and receiving data, and a plurality of ECUs (Electronic Control Units) (11-1 to 11-n) connected to the CAN bus (15).

[0049] The CAN bus (15) is a communication line for data transmission and may be composed of, for example, optical fiber or twisted pair wire. At this time, the two wires constituting the twisted pair wire may be driven by different signals (CAN_H, CAN_L).

[0050] The ECU (Electronic Control Unit) (11-1 to 11-n) may be various electronic control devices included in the vehicle. For example, the ECU (11-1 to 11-n) may include ECUs related to telematics or navigation, ECUs related to powertrains such as engines and transmissions, ECUs related to chassis such as brake systems, steering systems, and airbags, and ECUs related to bodies such as clusters, doors, and windows. Specifically, the ECU (11-1 to 11-n) may include ECUs related to all electronically controlled functions of the vehicle such as a smart key, a digital dashboard, ABS brakes, headlights, air conditioning, engine control, and cruise control.

[0051] Each ECU (11-1 to 11-n) can be connected to a CAN bus (15) via a specific CAN connector and can transmit and receive data using the CAN protocol.

[0052] Meanwhile, each ECU (11-1 to 11-n) may include a CAN transceiver (12), a CAN controller (13), and a microcontroller (CPU) (14).

[0053] A CAN transceiver (12) is connected to a CAN bus (15) via a predetermined CAN connector and can constitute a physical layer of an ECU. The CAN transceiver (12) can provide a function for detecting and managing a fault in the CAN bus (15) and a function for transmitting and receiving messages.

[0054] The CAN controller (13) can transmit and receive CAN protocol messages and perform a message filtering function for received messages. In addition, the CAN controller (13) can provide a message buffer for retransmission control and an interface function with a microcontroller (14).

[0055] The microcontroller (14) may include a CPU, provide upper layer protocols, and provide various applications to perform the functions of the ECU.

[0056] FIG. 2 is a diagram illustrating a CAN message format according to an embodiment of the present invention. For example, each ECU (11-1 to 11-n) of FIG. 1 can transmit and receive a CAN message (20) in the format shown in FIG. 2 via a CAN bus (15).

[0057] Referring to Fig. 2, a CAN message may include a CAN header (21) portion and a CAN payload (22), which is a data frame portion. The specification of the CAN message may follow the specification defined by the CAN protocol.

[0058] The CAN payload (22) may record information that the ECU wishes to transmit. For example, if the ECU is an engine ECU, data regarding the current status of the engine may be recorded in the CAN payload (22) field.

[0059] The CAN header (21) may include a CAN ID (21-1) field in which the ID of the corresponding message is recorded. At this time, the ID is an identifier of the corresponding message and may indicate the type of message. For example, a message including engine RPM information is periodically transmitted from an ECU related to engine control to the CAN bus (15), and all of the corresponding messages may have the same CAN ID. In other words, the CAN ID may correspond to a specific function of the corresponding vehicle. Meanwhile, the ECU receiving the message can determine which function the corresponding message includes data related to through the ID recorded in the message CAN ID (21-1) field.

[0060] Although CAN is described as an example of a vehicle communication protocol in FIGS. 1 and 2, the embodiment is not limited thereto. In the present invention, the vehicle communication protocol may include Extended CAN and CAN-FD (CAN with Flexible Data-Rate).

[0061] Figure 3 is a block diagram illustrating a configuration of an electronic device according to an embodiment of the present invention. For example, the electronic device (100) may be implemented as various computing devices such as a laptop, tablet, PC, server device, workstation, etc., but is not limited thereto.

[0062] Referring to FIG. 3, the electronic device (100) may include a memory (110) and a processor (120). The memory (110) may store various programs and data for controlling the operation of the electronic device (100).

[0063] In particular, according to one embodiment of the present invention, the memory (110) can store collected vehicle communication protocol data. For example, in a vehicle including the CAN communication system (10) of FIG. 1, CAN data transmitted and received via the CAN bus (15) for a predetermined period of time can be collected by a user, and the user can store the collected CAN data in the memory (110) of the electronic device (100).

[0064] According to one embodiment, CAN data generated during a predetermined period of time in a stationary vehicle may be collected and stored in memory (110). Additionally, CAN data generated during a predetermined period of time in a running vehicle may be collected and stored in memory (110). The collected CAN data stored in memory (110) may be processed by a processor (120), as described below, and used to predict functions by CAN ID.

[0065] Meanwhile, the collected vehicle communication protocol data is not limited to CAN data, and according to an embodiment, CAN-FD data may be collected and stored in memory (110) and may be used for function prediction by ID.

[0066] The processor (120) can control the overall operation of the electronic device (100). The processor (120) can be composed of one or more cores. The processor (120) can include at least one of a central processing unit (CPU), a general purpose graphics processing unit (GPGPU), an application processor (AP), a communication processor (CP), or a tensor processing unit (TPU), and can execute a program stored in the memory (110) to perform operations of the electronic device (100) according to various embodiments of the present invention.

[0067] In particular, the processor (120) can classify the collected vehicle communication protocol data stored in the memory (110) by ID. The vehicle communication protocol data collected over a given period of time may include numerous messages corresponding to various functions of the vehicle operating during that period. The processor (120) can classify these numerous messages by ID.

[0068] In addition, the processor (120) can generate an ID-specific signal based on vehicle communication protocol data classified by ID. According to one embodiment, the processor (120) can extract an ID-specific signal in preset time interval units from the vehicle communication protocol data classified by ID. For example, the processor (120) can extract an ID-specific signal in units of 100 ms, 200 ms, 300 ms, 500 ms, or 1 s, but is not limited thereto. Accordingly, the processor (120) can extract an ID-specific signal as a signal in various frequency bands.

[0069] Additionally, the processor (120) can extract features for each ID based on vehicle communication protocol data classified by ID and the signals for each ID. At this time, the features for each ID can include at least one of a similarity distance between IDs, a bit flip rate for each ID, and a bit histogram for each ID.

[0070] According to one embodiment, the processor (120) may extract at least one of a bit flip rate per ID and a bit histogram per ID from vehicle communication protocol data classified by ID. In addition, the processor (120) may extract a similarity distance between IDs based on the signal per ID. Here, the similarity distance between IDs may include a dynamic time warping (DTW) distance between different ID signals.

[0071] The Euclidean distance, which is commonly used to measure the similarity between two signals, measures the similarity (i.e., distance) between two signals on the same timeline. Therefore, it is difficult to find similarity as the shaking and movement of the signal become more severe, and it has the disadvantage of not being able to measure the distance for time series of different lengths.

[0072] In contrast, the DTW distance measures the similarity between two signals by matching them in the direction of minimizing distance and finding a warping path that minimizes the cumulative distance. Therefore, it can measure the similarity between two signals whose movements differ depending on speed or length. In other words, utilizing the DTW distance can overcome the limitations of the Euclidean distance measurement.

[0073] The aforementioned ID-specific signals may have different starting points, ending points, and lengths for each signal. Therefore, according to one embodiment of the present invention, the processor (120) can calculate the DTW distance between different ID signals and use this as a feature for each ID. Accordingly, the similarity distance between IDs can be used as a feature for predicting the function corresponding to the ID.

[0074] The closer the DTW distance between two ID signals, the more likely they are to have similar waveforms. Similar waveforms between ID signals can imply that messages from each ID occurred at similar frequencies during the same time interval. Since IDs occurring at similar frequencies during a specific time interval can be interpreted as having similar characteristics (or functions), the DTW distance between signals for each ID can be used as a feature to predict the functions of each ID.

[0075] For example, a signal with CAN ID 130 and a signal with CAN ID 140 have very close DTW distances and similar waveforms. According to published information, it can be known that both CAN IDs 130 and 140 are actually IDs related to the YRS (Yaw Rate Sensor) that detects the vehicle's torsion in the ESP (Electronic Stability System) system. Therefore, for example, if known function information exists for a first ID and no published function information exists for a second ID, and if the DTW distances of the first ID signal and the second ID signal are close, it can be determined that the second ID is also an ID that performs a similar function as the first ID in the vehicle.

[0076] Meanwhile, the processor (120) can predict functions corresponding to each ID included in the vehicle communication protocol data based on the extracted ID-specific features. For example, the processor (120) can input the extracted ID-specific features into an artificial intelligence model trained to predict functions corresponding to IDs, thereby predicting (or inferring) functions corresponding to each ID.

[0077] According to one embodiment, the processor (120) can train an artificial intelligence model to predict a function corresponding to an ID. For example, the memory (110) can store training vehicle communication protocol data and ID-specific function information. Here, the ID-specific function information is information that matches a function corresponding to an ID and can be a kind of target (or label) for training an artificial intelligence model. At this time, the ID-specific function information may be information obtained from a public vehicle communication protocol database that includes function information corresponding to an ID, but is not limited thereto. Meanwhile, the processor (120) can extract the aforementioned ID-specific features from the training vehicle communication protocol data. At this time, the extracted ID-specific features can be a kind of feature for training an artificial intelligence model. Therefore, the processor (120) can train an artificial intelligence model to predict a function corresponding to an ID by using the ID-specific features and ID-specific function information extracted from the training vehicle communication protocol data. The processor (120) can use the artificial intelligence model learned in this way to predict functions corresponding to each ID included in the collected vehicle communication protocol data.

[0078] In the above, an example of training an artificial intelligence model to predict a function corresponding to an ID has been described, but the embodiment is not limited thereto. For example, an artificial intelligence model may be trained to predict a function corresponding to an ID in another electronic device, and the trained artificial intelligence model may be stored in the memory (110). In this case, the processor (120) may use the trained artificial intelligence model stored in the memory (110) to predict functions corresponding to each ID included in the collected vehicle communication protocol data.

[0079] According to the various embodiments of the present invention described above, the ID-specific functions of the vehicle communication protocol can be automatically predicted quickly and accurately.

[0080] Hereinafter, the configuration and operation of a processor according to an embodiment of the present invention will be described with reference to FIGS. 4 to 6. FIG. 4 is a diagram illustrating the configuration of a processor according to an embodiment of the present invention, and FIGS. 5 and 6 are diagrams illustrating learning data according to an embodiment of the present invention.

[0081] Referring to FIG. 4, the processor (120) may include a signal generation unit (121), a feature extraction unit (122), a model learning unit (123), and a function determination unit (124).

[0082] The signal generation unit (121) can generate signals by ID from CAN data. Specifically, when CAN data is input from the memory (110), the signal generation unit (121) can classify the CAN data by ID and generate signals by ID based on the CAN data classified by ID. At this time, the signal generation unit (121) can extract signals by ID from the CAN data classified by ID in preset time interval units to generate signals by ID. Depending on the time period for extracting the signals, signals by ID in various frequency bands can be generated.

[0083] The feature extraction unit (122) can extract features to be used for predicting the function of the CAN ID from the ID-specific signals generated by the signal generation unit (121). For example, the feature extraction unit (122) can extract features for each ID based on the CAN data classified by ID and the signals for each ID. At this time, the features for each ID can include at least one of a similarity distance between IDs, a bit flip rate for each ID, and a bit histogram for each ID. According to one embodiment, the feature extraction unit (122) can extract at least one of a bit flip rate for each ID and a bit histogram for each ID from the CAN data classified by ID. In addition, the feature extraction unit (122) can extract a similarity distance between IDs based on the signals for each ID. At this time, the similarity distance between IDs can include a DTW distance between different ID signals.

[0084] The function determination unit (124) can predict functions corresponding to each ID included in the CAN data based on the extracted ID-specific features. For example, if an artificial intelligence model trained to predict functions corresponding to IDs exists in the memory (110), the function determination unit (124) can input the extracted ID-specific features into the trained artificial intelligence model to predict functions corresponding to each ID included in the CAN data.

[0085] At this time, according to one embodiment, the learned artificial intelligence model may be a model learned based on CAN data collected from the same vehicle from which the CAN data that is the subject of the ID-specific responsible function analysis is collected. Alternatively, according to one embodiment, the learned artificial intelligence model may be a model learned based on CAN data collected from a different vehicle from which the CAN data that is the subject of the ID-specific responsible function analysis is collected.

[0086] The model learning unit (123) can learn an artificial intelligence model based on the extracted ID-specific features. For example, when learning CAN data is received, ID-specific features for the learning CAN data can be extracted by the signal generation unit (121) and the feature extraction unit (122). The model learning unit (123) can use the ID-specific features for the learning CAN data extracted in this way as features for learning an artificial intelligence model. At this time, according to one embodiment, the model learning unit (123) can preprocess the extracted ID-specific features into a form as shown in FIG. 5 or a graph form so that the extracted ID-specific features can be well reflected in learning. Referring to FIG. 5, the learning feature data can include a source, a target, a dtw distance, a source bit flip (SBF), a target bit flip (TBF), a source bit histogram (SBH), a target bit histogram (TBH), etc. At this time, the signal with CAN ID 367 may become the source, and signals of other CAN IDs may become targets. In addition, the dtw distance represents the dtw distance between the source and target signals. At this time, although FIG. 5 shows the dtw distance between the source signal and the target signal extracted in units of 100 ms, it is not limited thereto, and it goes without saying that the dtw distance of the source and the target calculated based on the signals for each ID extracted in units of 200 ms, 300 ms, 500 ms, or 1 s may be further used as feature data for learning. In FIG. 5, the feature data for learning includes all of the source, target, dtw distance, source bit flip (SBF), target bit flip (TBF), source bit histogram (SBH), and target bit histogram (TBH), but the embodiment is not limited thereto. For example, the training feature data may include only source, target, and dtw distances, or may additionally include bit flip data or bit histogram data of the source or target, depending on the embodiment.

[0087] Meanwhile, the model learning unit (123) can use ID-specific functional information as a target. At this time, the ID-specific functional information can be obtained from a public CAN database containing functional information corresponding to the ID, but is not limited thereto, and can also be experimentally or arbitrarily created by a user. The ID-specific functional information can be obtained or created in this manner and stored in the memory (110). Fig. 6 illustrates an example of learning target data obtained from a public CAN database. Referring to Fig. 6, the learning target data can include CAN IDs and names, labels, and descriptions corresponding to each CAN ID, but is not limited thereto.

[0088] Accordingly, the model learning unit (123) can learn an artificial intelligence model to predict a function corresponding to an ID by using the ID-specific features and ID-specific function information extracted from the learning CAN data.

[0089] Meanwhile, the artificial intelligence model learned by the model learning unit (123) may include various neural network models such as ANN (Artificial Neural Network), DNN (Deep Neural Network), CNN (Convolution Neural Network), RNN (Recurrent Neural Network), etc., but is not limited thereto.

[0090] The artificial intelligence model learned in the model learning unit (123) can be used by the function determination unit (124) to predict functions corresponding to each ID included in the CAN data.

[0091] In FIGS. 4 to 6, the case where the prediction data or the learning data is CAN data is exemplified, but the embodiment is not limited thereto, and it goes without saying that CAN-FD data can be used for ID-specific function prediction and artificial intelligence model learning according to the embodiment. In addition, in FIG. 4, an example is illustrated where the processor (120) includes both the model learning unit (123) and the function determination unit (124), but the embodiment is not limited thereto, and the processor (120) may include at least one of the model learning unit (123) and the function determination unit (124).

[0092] FIG. 7 is a block diagram illustrating an implementation example of an electronic device according to an embodiment of the present invention. FIG. 7 comprehensively illustrates various components that may be included in the electronic device (100A). Therefore, depending on the embodiment, some of the components illustrated in FIG. 7 may be omitted or changed, and other components may be added. In describing FIG. 7, redundant descriptions of components identical to those of the electronic device (100) described above will be omitted or simplified.

[0093] Referring to FIG. 7, the electronic device (100A) may include a memory (110), a processor (120), a communication unit (130), a user input unit (140), and a display (150).

[0094] The memory (110) can store an operating system (OS) for controlling the overall operation of the electronic device (100A). In addition, the memory (110) can store various algorithms, programs, data, etc. for performing various functions of the electronic device (100) described above. In particular, the memory (110) can store the vehicle communication protocol data, artificial intelligence model, ID-specific function information, etc. described above.

[0095] For this purpose, the memory (110) may include volatile memory such as DRAM, SRAM, and non-volatile memory such as EEPOM and flash memory that can retain information even when the power is off. In addition, the memory (110) may include a hard disk drive (HDD), a solid state drive (SSD), or a memory card (e.g., an SD card, a memory stick) that can be removed or attached to the electronic device (100).

[0096] The processor (120) controls the overall operation of the electronic device (100A). In particular, the processor (120) can perform various operations and data processing, and control the operations of other components, in order to perform the operations of the processor (120) according to various embodiments of the present invention described above.

[0097] To this end, the processor (120) can control hardware or software components connected to the processor (120) by running an operating system or application program, and can perform various data processing and operations. In addition, the processor (120) can load commands or data received from at least one of the other components into volatile memory and process them, and store various data in non-volatile memory.

[0098] The communication unit (130) can communicate with various external devices according to various types of communication methods. For example, the communication unit (130) can communicate with an external server that stores a public database that analyzes and provides functions of vehicle communication protocol IDs for each vehicle. In addition, the communication unit (130) can communicate with an external server that stores vehicle communication protocol data for learning or analysis. Accordingly, the processor (120) can request and receive ID-specific function information or vehicle communication protocol data from an external server through the communication unit (130). In addition, the communication unit (130) can perform Internet communication.

[0099] For this purpose, the communication unit (130) may include a wired or wireless LAN communication module. In addition, the communication unit (130) may also include a short-range wireless communication module (not shown) or a mobile communication module depending on the embodiment. Here, the short-range wireless communication module (not shown) refers to a communication module that performs data communication wirelessly with an electronic device located in a short distance, such as a Bluetooth module, a ZigBee module, an NFC (Near Field Communication) module, etc. In addition, the mobile communication module refers to a communication module that performs communication by connecting to a mobile communication network according to various mobile communication standards, such as 3G (3rd Generation), 3GPP (3rd Generation Partnership Project), and LTE (Long Term Evoloution).

[0100] According to an embodiment, the communication unit (130) may include a broadcast receiving module and may include at least one of wired communication modules (not shown) such as USB (Universal Serial Bus), IEEE (Institute of Electrical and Electronics Engineers) 1394, RS-232, etc.

[0101] The user input unit (140) can receive various user commands such as control commands, selection commands, and input commands. For this purpose, the user input unit (140) may include a keyboard, buttons, a key pad, a touch pad, and a touch screen. Alternatively, the user input unit (140) may be implemented as an input / output port. In this case, the user input unit (140) may be referred to as an input / output interface. When the user input unit (140) is implemented as an input / output port, the input / output port may include an HDMI (High-Definition Multimedia Interface), DP (DisplayPort), RGB, DVI (Digital Visual Interface), USB (Universal Serial Bus), Thunderbolt, an audio jack, a video jack, and the like. The user input unit (140) may be referred to as an input device, an input unit, an input module, and the like, and when implemented as an input / output port, may be referred to as an input / output device, an input / output unit, an input / output module, and the like.

[0102] The display (150) can display various visual information such as still images, moving images, user interfaces (UI), icons, etc. under the control of the processor (120). To this end, the display (150) can be implemented in various forms such as an LCD (Liquid Crystal Display Panel), an LED (light emitting diode), an OLED (Organic Light Emitting Diodes), a micro LED, etc. In addition, the display (150) can be implemented in the form of a touch screen by being combined with a touch panel.

[0103] FIG. 8 is a flowchart illustrating an operation method of an electronic device according to an embodiment of the present invention. Referring to FIG. 8, in step S810, the electronic device (100, 100A) can classify collected vehicle communication protocol data by ID. At this time, the vehicle communication protocol data may include at least one of CAN data and CAN-FD data. In addition, the vehicle communication protocol data may include at least one of vehicle communication protocol data generated in a stopped vehicle and vehicle communication protocol data generated in a running vehicle.

[0104] At step S820, the electronic device (100, 100A) can generate an ID-specific signal based on vehicle communication protocol data classified by ID. For example, the electronic device (100, 100A) can extract an ID-specific signal at preset time intervals from the vehicle communication protocol data classified by ID.

[0105] In step S830, the electronic device (100, 100A) may extract features for each ID based on vehicle communication protocol data classified by ID and signals for each ID. At this time, the features for each ID may include a similarity distance between IDs. At this time, the similarity distance between IDs may include, but is not limited to, a DTW distance between different ID signals. In addition, according to an embodiment, the features for each ID may further include at least one of a bit flip rate for each ID and a bit histogram for each ID in addition to the similarity distance between IDs. At this time, the electronic device (100, 100A) may extract at least one of a bit flip rate for each ID and a bit histogram for each ID from vehicle communication protocol data classified by ID, and extract the similarity distance between IDs based on the signals for each ID.

[0106] At step S840, the electronic device (100, 100A) can predict or infer functions corresponding to each ID included in the vehicle communication protocol data based on the extracted ID-specific features. For example, the electronic device (100, 100A) can predict or infer functions corresponding to each ID included in the vehicle communication protocol data using an artificial intelligence model trained to predict functions corresponding to IDs.

[0107] In this case, according to one embodiment, the artificial intelligence model may be a model learned based on vehicle communication protocol data collected from the same vehicle from which the vehicle communication protocol data is collected. Alternatively, the artificial intelligence model may be a model learned based on vehicle communication protocol data collected from a different vehicle from which the vehicle communication protocol data is collected.

[0108] FIG. 9 is a flowchart illustrating an operation method of an electronic device according to an embodiment of the present invention. Referring to FIG. 9, the electronic device (100, 100A) can classify learning vehicle communication protocol data by ID at step S910.

[0109] In step S920, the electronic device (100, 100A) can generate an ID-specific signal based on vehicle communication protocol data classified by ID. In addition, in step S930, the electronic device (100, 100A) can extract an ID-specific feature based on the vehicle communication protocol data classified by ID and the ID-specific signal. Since the operation of the electronic device (100, 100A) in steps S920 and S930 is similar to steps S820 and S830 of FIG. 8, a duplicate description will be omitted.

[0110] At step S940, the electronic device (100, 100A) may generate a function prediction model for each ID. Specifically, the electronic device (100, 100A) may train an artificial intelligence model to predict a function corresponding to each ID based on ID-specific features and ID-specific function information extracted from the training CAN data. At this time, the ID-specific function information may be obtained from a public CAN database containing function information corresponding to each ID, but is not limited thereto.

[0111] FIG. 10 is a flowchart for explaining an operation method of an electronic device according to an embodiment of the present invention.

[0112] In step S1010, the electronic device (100, 100A) can input the collected CAN data to be predicted through the user input unit (140). Accordingly, in step S1020, the electronic device (100, 100A) can classify the data by CAN ID from the input CAN data. In addition, in step S130, the electronic device (100, 100A) can generate a signal by CAN ID from the data classified by CAN ID. At this time, the signal by CAN ID can be generated by extracting the data classified by CAN ID in preset time interval units such as 100 ms, 200 ms, and 300 ms, depending on the embodiment.

[0113] Meanwhile, in step S1040, the electronic device (100, 100A) can extract features for each CAN ID. For example, the electronic device (100, 100A) can extract features such as bit flip rate or bit histogram from data classified for each CAN ID. In addition, the electronic device (100, 100A) can calculate the DTW distance for each signal for each CAN ID and extract similarity distance features between IDs.

[0114] Accordingly, the electronic device (100, 100A) determines whether a learned model that classifies the responsible function by CAN ID exists in step S1050, and if it exists (S1050, Yes), proceeds to step S1070 to predict the responsible function by CAN ID using the learned model.

[0115] Meanwhile, in step S1050, if there is no learned model that classifies the responsible function by CAN ID (S1050, No), the electronic device (100, 100A) proceeds to step S1060, receives CAN data for learning from the CAN database (200), extracts features to be used for learning the responsible function prediction by CAN ID from the received learning CAN data, and then learns the model using these features, thereby generating a CAN ID-specific responsible function prediction model.

[0116] In the above, embodiments of predicting the ID-specific responsible function of collected vehicle protocol data using an artificial intelligence model learned using the same vehicle communication protocol data as the collected vehicle communication protocol data have been described. That is, in the above, embodiments of predicting the ID-specific responsible function of collected CAN data using a model learned through CAN data, or predicting the ID-specific responsible function of collected CAN-FD data using a model learned through CAN-FD data have been described. However, the embodiments are not limited thereto, and depending on the embodiment, it may be possible to predict the ID-specific responsible function of collected CAN-FD data using a model learned through CAN data, or vice versa.

[0117] According to various embodiments of the present invention as described above, it is possible to automatically, quickly and accurately predict the ID-specific functions of a vehicle communication protocol.

[0118] Specifically, by using an automated analysis tool rather than heuristic analysis for CAN IDs (or CAN-FD IDs) with different functions depending on the vehicle manufacturer or model, not only analysis experts but also general users can easily and quickly perform an accurate analysis of the functions assigned to each CAN ID.

[0119] Additionally, by analyzing the assigned function by CAN ID (or CAN-FD ID), payloads can be generated to enable the desired function to operate, making it easier to determine whether the vehicle's assigned function is operating properly. This allows for rapid repairs to only the faulty part.

[0120] Furthermore, given the growing importance of vehicle cybersecurity, as highlighted by ISO 21434, the various embodiments of the present invention described above can be utilized to identify vulnerabilities and strengthen security through simulated hacking, which involves causing malfunctions in the designated function by CAN ID. Furthermore, by detecting and blocking abnormal behavior occurring in the vehicle by designated function, accidents caused by unintended actions can be prevented in advance.

[0121] Meanwhile, various embodiments of the present disclosure may be implemented as software including commands stored in a machine-readable storage medium that can be read by a machine (e.g., a computer). Here, the device may include an electronic device (100, 100A) according to the disclosed embodiments, as a device capable of calling commands stored in the storage medium and operating according to the called commands.

[0122] When the above command is executed by the processor, the processor may directly, or under the control of the processor, perform a function corresponding to the command by using other components. The command may include code generated or executed by a compiler or interpreter. The machine-readable storage medium may be provided in the form of a non-transitory storage medium. Here, 'non-transitory' means that the storage medium does not contain signals and is tangible, but does not distinguish whether data is stored semi-permanently or temporarily in the storage medium.

[0123] According to one embodiment, the method according to various embodiments disclosed in the present disclosure may be provided as included in a computer program product. The computer program product may be traded as a product between a seller and a buyer. The computer program product may be distributed in the form of a machine-readable storage medium (e.g., compact disc read-only memory (CD-ROM)) or online through an application store (e.g., Play Store™). In the case of online distribution, at least a portion of the computer program product may be temporarily stored or temporarily generated in a storage medium, such as the memory of a manufacturer's server, an application store's server, or a relay server.

[0124] Each component (e.g., a module or a program) according to various embodiments may be composed of one or more entities, and some of the aforementioned sub-components may be omitted, or other sub-components may be further included in various embodiments. Alternatively or additionally, some components (e.g., a module or a program) may be integrated into a single entity, which may perform the same or similar functions as those performed by each of the respective components prior to integration. Operations performed by a module, program, or other component according to various embodiments may be executed sequentially, in parallel, iteratively, or heuristically, or at least some operations may be executed in a different order, omitted, or other operations may be added.

[0125] The above description is merely an illustrative description of the technical idea of ​​the present disclosure, and those skilled in the art to which the present disclosure pertains will appreciate that various modifications and variations may be made without departing from the essential characteristics of the present disclosure. In addition, the embodiments according to the present disclosure are not intended to limit the technical idea of ​​the present disclosure, but rather to illustrate it, and the scope of the technical idea of ​​the present disclosure is not limited by these embodiments. Therefore, the scope of protection of the present disclosure should be interpreted by the following claims, and all technical ideas within a scope equivalent thereto should be interpreted as being included in the scope of rights of the present disclosure.

Claims

1. In a method for identifying functions by ID of a vehicle communication protocol performed by an electronic device, A step of classifying the collected vehicle communication protocol data by ID; A step of generating an ID-specific signal based on vehicle communication protocol data classified by the ID; A step of extracting features for each ID based on vehicle communication protocol data classified by the ID and signals for each ID; and A method for identifying functions by ID, comprising: a step of predicting functions corresponding to each ID included in the vehicle communication protocol data based on the extracted ID-specific features; 2. In paragraph 1, The above vehicle communication protocol data is, A method for identifying functions by ID, comprising at least one of CAN (Controller Area Network) data and CAN-FD (CAN with Flexible Data rate) data.

3. In paragraph 1, The above vehicle communication protocol data is, A method for identifying functions by ID, comprising at least one of vehicle communication protocol data generated from a vehicle in a stationary state and vehicle communication protocol data generated from a vehicle in a running state.

4. In paragraph 1, The step of generating the signal by ID is as follows: A method for identifying functions by ID, comprising: a step of extracting signals by ID in preset time interval units from vehicle communication protocol data classified by ID; 5. In paragraph 1, The above ID-specific features are: A method for feature identification per ID, comprising at least one of a similarity distance between IDs, a bit flip rate per ID, and a bit histogram per ID.

6. In paragraph 5, The step of extracting features by ID is as follows: A step of extracting at least one of a bit flip rate per ID and a bit histogram per ID from vehicle communication protocol data classified by the ID; and A method for identifying functions by ID, comprising: a step of extracting a similarity distance between the IDs based on the signal by ID; 7. In paragraph 5, The similarity distance between the above IDs is A method for feature identification by ID, including dynamic time warping (DTW) distances between different ID signals.

8. In paragraph 1, The step of predicting the functions corresponding to each of the above IDs is: A method for identifying features by ID, comprising the step of inputting the extracted features by ID into an artificial intelligence model trained to predict features corresponding to the ID.

9. In paragraph 8, The above artificial intelligence model, A method for identifying functions by ID, wherein the model is learned based on vehicle communication protocol data collected from the same vehicle as the vehicle from which the above vehicle communication protocol data is collected.

10. In paragraph 8, The above artificial intelligence model, A method for identifying features by ID, wherein the model is learned based on vehicle communication protocol data collected from a vehicle other than the vehicle from which the above vehicle communication protocol data is collected.

11. In paragraph 1, A method for identifying features by ID, comprising: a step of learning an artificial intelligence model based on the extracted features by ID.

12. In paragraph 11, The steps of learning the above artificial intelligence model are: Based on the extracted ID-specific features and ID-specific function information, the artificial intelligence model is trained to predict the function corresponding to the ID, The above ID-specific function information is: A method for identifying functions by ID, obtained from a vehicle communication protocol database containing information on functions corresponding to the ID.

13. In electronic devices, A memory for storing collected vehicle communication protocol data; and An electronic device comprising a processor that classifies the collected vehicle communication protocol data by ID, generates an ID-specific signal based on the vehicle communication protocol data classified by ID, extracts ID-specific features based on the vehicle communication protocol data classified by ID and the ID-specific signal, and predicts functions corresponding to each ID included in the vehicle communication protocol data based on the extracted ID-specific features.

14. In paragraph 13, The above processor, An electronic device that extracts signals by ID at preset time intervals from vehicle communication protocol data classified by ID.

15. In paragraph 13, The above ID-specific features are: An electronic device comprising at least one of a similarity distance between IDs, a bit flip rate per ID, and a bit histogram per ID.

16. In paragraph 15, The above processor, An electronic device that extracts at least one of a bit flip rate per ID and a bit histogram per ID from vehicle communication protocol data classified by the ID, and extracts a similarity distance between the IDs based on the signal per ID.

17. In paragraph 15, The similarity distance between the above IDs is An electronic device comprising a dynamic time warping (DTW) distance between different ID signals.

18. In paragraph 13, The above memory is, Save the artificial intelligence model trained to predict the function corresponding to the ID, The above processor, An electronic device that inputs the extracted ID-specific features into the artificial intelligence model to predict functions corresponding to each ID included in the vehicle communication protocol data.

19. In paragraph 13, The above processor, An electronic device that learns an artificial intelligence model based on the extracted ID-specific features.

20. A non-transitory computer-readable recording medium storing computer instructions that, when executed by a processor of an electronic device, cause the electronic device to perform an operation, The above action is, A step of classifying the collected vehicle communication protocol data by ID; A step of generating an ID-specific signal based on vehicle communication protocol data classified by the ID; A step of extracting features for each ID based on vehicle communication protocol data classified by the ID and signals for each ID; and A recording medium comprising a step of predicting functions corresponding to each of the IDs included in the vehicle communication protocol data based on the extracted ID-specific features.

Images