Adaptive Sensor Sampling for Vehicle Attack Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional attack detection methods for vehicle sensor data face challenges in accurately detecting attacks while reducing data volume, often failing to include attack messages due to arbitrary sampling intervals and difficulty in determining attack presence based on data acquisition intervals.
Innovation Solution
An attack detection method that determines sampling rules based on statistical variations and event information to select sensor values, generating sampling data with first and second-order information, and calculates anomaly scores to accurately identify attacks, reducing data volume while enhancing detection performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of energy
If data sampling is performed at arbitrary time intervals to reduce data volume, then communication cost and computation cost are reduced, but attack messages may be missed and detection accuracy deteriorates
Solution Approach 1:
The patent applies dynamics by making the sampling interval adaptive rather than fixed. The monitoring system dynamically adjusts the sampling interval based on the statistical properties of the sensor data, such as standard deviation and variance. When data variability is high, the system increases sampling frequency to capture potential attack messages, and reduces frequency when variability is low, thus resolving the contradiction between data reduction and detection accuracy.
Solution Approach 2:
The patent changes the parameter of sampling interval from a constant value to a variable determined by statistical analysis of the sensor data. By calculating metrics like standard deviation and variance over time windows, the system adjusts the sampling interval parameter adaptively, allowing it to optimize both data volume reduction and attack detection performance based on actual data characteristics.
2Quantity of substance
If sampling interval is extended to reduce data amount, then communication bandwidth and storage requirements are reduced, but the ability to detect attacks occurring between samples deteriorates
Solution Approach 1:
The system dynamically adjusts the sampling interval based on real-time statistical analysis of data variability. When the standard deviation or variance exceeds thresholds indicating potential attacks, the sampling interval is automatically reduced to increase detection coverage, thereby maintaining reliability while managing data volume.
Solution Approach 2:
The monitoring system implements feedback by continuously analyzing the statistical properties of sampled data and using this information to adjust future sampling decisions. The system calculates variance and standard deviation metrics, compares them against thresholds, and feeds this information back into the sampling interval selection logic, creating a closed-loop system that adapts to changing conditions.
3Device complexity
If fixed sampling intervals are used to simplify the monitoring system, then device complexity is reduced, but detection performance under varying attack conditions deteriorates
Solution Approach 1:
The patent transforms the static sampling interval into a dynamic parameter that automatically adapts to different operating conditions and attack scenarios. By using statistical metrics like standard deviation and variance to guide sampling decisions, the system achieves adaptability without requiring complex manual configuration or multiple specialized sampling strategies for different conditions.
Data Source
AI summary
An attack detection method includes determining a sampling rule including a sampling interval and a sampling time on the basis of at least one of a statistic indicating a variation in sensor values included in the sensor data or event information on the mobility entity, which indicates the timing of a change in sensor values; generating sampling data including two or more sensor values selected from the sensor data on the basis of the sampling interval and the sampling time, first order information, and second order information; and calculating a first anomaly score indicating the degree of anomalies in the evaluation target data and a second anomaly score indicating the degree of anomalies in the evaluation target data, determining on the basis of the calculated first and second anomaly scores whether the evaluation target data has resulted from the attack, and outputting a determination result.