Adaptive Connected Vehicle Threat Detection With Distributed Log Filtering

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Connected vehicles face challenges in deploying intrusion detection and prevention systems (IDPS) due to limited hardware resources, restricted network accessibility, and highly customized operating systems, leading to difficulties in effectively identifying and aggregating duplicate event detections across multiple execution environments.

Innovation Solution

An adaptive framework for deploying IDPS with detection probes and hubs onboard the vehicle and a detection correlation backend on the cloud, utilizing packet and detection log filtering mechanisms, along with monotonic timestamps to manage resource usage and synchronize event detections.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If conventional IDPS is deployed in connected vehicles, then network threat detection capability is improved, but hardware resource consumption increases beyond available limits

Engineering Contradiction:

Improvenetwork threat detection capabilityVSAvoidhardware resource consumption

Core Design Contradiction:

ReliabilityVSUse of energy by moving object

Solution Approach 1:

The IDPS is segmented into three distinct components distributed across different locations: detection probes in the vehicle, detection hubs at the edge, and detection correlation backend in the cloud. This segmentation allows each component to perform specialized functions with reduced resource requirements, enabling threat detection capability while respecting the limited hardware resources available in the vehicle.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

Detection hubs serve as intermediaries between detection probes in vehicles and the detection correlation backend in the cloud. The hubs aggregate detection logs from multiple probes, perform preliminary analysis, and forward only relevant data to the backend, thereby reducing the bandwidth and computational burden on both vehicle hardware and cloud resources.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If detection probes scan all raw packets for threats, then detection completeness is improved, but processing time and resource usage increase

Engineering Contradiction:

Improvedetection completenessVSAvoidpacket processing time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

Packet filtering is performed as a preliminary action before threat detection scanning. The detection probes apply filter rules to raw packets to identify and extract only those packets that are potentially relevant to security threats. This preliminary filtering reduces the volume of data that requires intensive scanning analysis, thereby maintaining detection completeness while significantly reducing processing time and resource consumption.

Inventive Principle:

Principle #10Preliminary action

3Measurement precision

If detection logs from multiple probes are aggregated centrally, then threat correlation accuracy is improved, but network bandwidth and backend burden increase

Engineering Contradiction:

Improvethreat correlation accuracyVSAvoidnetwork bandwidth consumption

Core Design Contradiction:

Measurement precisionVSLoss of energy

Solution Approach 1:

The system extracts and filters detection logs at the probe level before aggregation, removing redundant and low-value log entries. Detection hubs perform additional filtering and aggregation of logs from multiple probes, extracting only the most relevant security events. This extraction process maintains threat correlation accuracy by preserving critical security information while reducing network bandwidth consumption and backend processing burden.

Inventive Principle:

Principle #2Taking out (Extraction)

4Reliability

If IDPS is deployed across multiple execution environments, then detection coverage is improved, but difficulty in managing duplicate detections increases

Engineering Contradiction:

Improvedetection coverageVSAvoidduplicate detection management complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The detection correlation backend receives detection logs from multiple probes across different execution environments and implements a feedback mechanism to identify and eliminate duplicate detections. The system correlates detection events based on temporal, spatial, and contextual attributes, providing feedback to adjust detection sensitivity and reduce false duplicates. This feedback loop maintains comprehensive detection coverage across multiple environments while managing duplicate detection complexity.

Inventive Principle:

Principle #23Feedback

Data Source

PatentUS12388857B1Adaptive network threat detection in distributed automotive execution environments of connected vehicles

Publication Date: 2025.08.12 VICONE CORP

AI summary

An intrusion detection and prevention system (IDPS) has detection probes and detection hubs that are deployed onboard a connected vehicle and a detection correlation backend that is deployed on the cloud. A detection probe receives raw packets of network traffic of a communication network of the connected vehicle. The detection probe filters the raw packets in accordance with packet filter rule entries to generate packets of interest. The detection probe scans the packets of interest for data indicative of network threats and outputs corresponding unfiltered detection logs. The detection probe filters the unfiltered detection logs in accordance with detection filter rule entries to generate detection logs of interest. A detection hub aggregates detection logs of interest from one or more detection probes to generate aggregated detection logs. A detection correlation backend evaluates the aggregated detection logs to detect network threats.