Anomaly Detection ECU for Onboard Network Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security measures for onboard CAN networks fail to effectively detect unauthorized messages, particularly when attackers transmit anomalous data at the same cycle as legitimate messages or stop legitimate transmissions, leading to undetected unauthorized control of ECUs.
Innovation Solution
An anomaly detection electronic control unit (ECU) that periodically transmits and receives specific messages, using a processor to determine normalcy based on content comparisons between first-type and second-type messages, and transmitting error frames or notifications to invalidate or alert against anomalous data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If existing security measures check only communication intervals, then implementation is simple, but detection precision is insufficient when attackers mimic legitimate message cycles
Solution Approach 1:
The detection mechanism is segmented into multiple independent comparison units: current message content comparison, historical message pattern comparison, and cross-message data consistency comparison. Each unit checks specific aspects of message integrity separately, allowing comprehensive detection without requiring a monolithic complex system.
Solution Approach 2:
The system pre-stores legitimate message content and historical communication patterns in memory before actual detection occurs. By having reference data ready in advance, the system can quickly compare incoming messages against known good patterns without complex real-time analysis, improving detection precision while maintaining simplicity.
2Reliability
If the system monitors only current message intervals, then processing is fast, but reliability is reduced when legitimate transmissions are stopped
Solution Approach 1:
The system pre-caches multiple historical message patterns and legitimate content variations in memory before detection is needed. When messages are transmitted, the system quickly checks against pre-stored patterns rather than building analysis from scratch, maintaining fast processing while improving reliability through multiple reference points including historical data.
Solution Approach 2:
The system continuously monitors and stores communication patterns over time, building a growing repository of legitimate message patterns. This continuous accumulation of reference data ensures that even when legitimate transmissions are stopped or altered, the system has historical patterns to compare against, maintaining detection reliability without requiring continuous real-time analysis of every message interval.
3Measurement precision
If comprehensive message content comparison is performed, then detection precision improves, but processing speed decreases
Solution Approach 1:
The comprehensive comparison is segmented into hierarchical levels: first checking message ID and basic format, then checking content against pre-stored patterns, and finally performing detailed data consistency checks only when needed. This segmentation allows most messages to be processed quickly with minimal checks while maintaining high detection precision for anomalous messages.
Solution Approach 2:
The system changes the depth of comparison based on message characteristics. For routine messages matching known patterns, only shallow comparison is performed. For messages deviating from patterns, the system increases comparison depth to examine historical patterns and cross-message consistency. This dynamic parameter adjustment maintains processing speed while improving detection precision when needed.
Data Source
AI summary
An anomaly detection electronic control unit (ECU) that detects unauthorized messages on a communication path is provided. An ECU that periodically transmits a first-type message including data to be monitored, and an ECU that periodically transmits a second-type message including data for comparison, are connected to the communication path. The anomaly detection ECU includes: a receiver that successively receives first-type and second-type messages; a processor that determines whether a first-type message received is normal or anomalous; and a transmitter that transmits a predetermined message in accordance with results of the determining. The determining is performed based on content of the first-type message, content of a second-type message last received at the time of receiving this first-type message, and at least one of content of a first-type message received further in the past than this first-type message, and content of a second-type message received further in the past than the second-type message last received.