Automotive Ethernet Switch Anomaly Detection via Monolithic Coupling
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional anomaly detection systems in automotive Ethernet networks require dedicated hardware and static architectures, which can be cumbersome and inefficient for monitoring data traffic within vehicle communication systems, particularly in detecting anomalies caused by faulty sensors, damaged components, or external manipulations like hacker attacks.
Innovation Solution
A device and method that integrate a network-based intrusion detection and prevention system (NIDPS) into an automotive Ethernet switch, utilizing a monolithic coupling element with a distribution unit, computing unit, and internal interface to analyze data packets directly within the switch, enabling efficient anomaly detection and prevention without disrupting the switch's function, and allowing for extensive analysis of Ethernet packets on a microcontroller.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If dedicated hardware components and static architecture are added to the communication network structure, then anomaly detection capability is improved, but device complexity and manufacturing difficulty increase
Solution Approach 1:
The patent merges the NIDS functionality with the existing Ethernet switch architecture by integrating a monitoring copy function into the switch's data forwarding path. Instead of adding separate dedicated hardware components, the system uses the switch's existing resources to create a copy of data packets for analysis, thereby improving anomaly detection capability without significantly increasing device complexity
Solution Approach 2:
The Ethernet switch is designed to perform multiple functions simultaneously: it acts as both a data forwarding device and an anomaly detection system. The switch's existing infrastructure is leveraged to provide NIDS functionality, making the system more versatile while avoiding the need for separate dedicated hardware components
2Reliability
If data traffic is transferred from a central switch to a separate NIDS component, then anomaly detection is improved, but transmission speed and productivity decrease
Solution Approach 1:
The system creates a copy of data packets at the Ethernet switch level and directs this copy to the NIDS component for analysis. The original data traffic continues to flow through the switch without interruption, while the copied packets are analyzed separately. This copying mechanism enables anomaly detection without impacting the transmission speed of the main data flow
3Reliability
If NIDS hardware is integrated directly on the switch, then anomaly detection capability is improved, but ease of manufacture and device complexity increase
Solution Approach 1:
The system segments the NIDS functionality from the main switch hardware by using a separate but connected NIDS component. The Ethernet switch handles data forwarding while the separate NIDS component performs anomaly detection on copied packets. This segmentation allows each component to be manufactured and optimized independently, improving ease of manufacture while maintaining enhanced anomaly detection capability
Data Source
AI summary
In a method and a device for detecting anomalies in data in data traffic across a communication network in a vehicle, the device encompasses a plurality of hardware interfaces and a monolithic coupling element designed for transmitting data arriving at one of the hardware interfaces in a data packet via at least one of the hardware interfaces and analyzing the data packet or a copy of the data packet for a detection of anomalies in the data of the communication network or of a subsystem of the communication network connected to one of the hardware interfaces.