Vehicle Bus Intrusion Detection Using Message Count Thresholds
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Modern vehicles are susceptible to attacks on their bus systems, such as CAN bus systems, which current detection methods struggle to adequately address, particularly denial-of-service attacks that interfere with communication by transmitting excessive or manipulated messages.
Innovation Solution
A method and device for detecting intrusions in bus systems by monitoring the number of messages transmitted by components within a specific time period and comparing it to predefined criteria, reducing the need for complex interval or frequency monitoring and enhancing reliability against manipulation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If interval-based monitoring or frequency-based monitoring is used to detect attacks, then detection capability is provided, but the system requires complex configuration and maintenance of multiple parameters for different message types
Solution Approach 1:
The patent segments the attack detection problem by separating the counting function from the analysis function. The counting unit independently counts messages from each component, while the evaluation unit performs the intrusion detection analysis. This segmentation allows the system to avoid complex per-message-type monitoring while maintaining detection capability.
Solution Approach 2:
The patent implements a universal counting mechanism that works for all message types without requiring type-specific configuration. The counting unit universally counts all messages from a component regardless of message type, and the evaluation unit universally evaluates these counts against predefined criteria, making the system adaptable to any message type without additional configuration.
2Reliability
If interval-based monitoring is used to detect attacks, then detection capability is provided, but the system generates false positives when message intervals change legitimately
Solution Approach 1:
The patent employs dynamic evaluation criteria that can adapt to legitimate changes in message transmission patterns. The system counts messages over a predefined time period and evaluates whether the count meets intrusion criteria, allowing legitimate interval variations while detecting actual intrusions. This dynamic approach reduces false positives compared to static interval thresholds.
Solution Approach 2:
The patent introduces an intermediary counting mechanism that aggregates message information before evaluation. Instead of directly monitoring individual message intervals or frequencies, the system uses a counting unit as an intermediary that summarizes message activity, providing a more robust basis for intrusion detection that is less sensitive to legitimate variations in transmission timing.
3Reliability
If entropy-based approaches are used to detect attacks by analyzing message content, then detection capability is provided, but the system requires complex entropy calculation and analysis overhead
Solution Approach 1:
The patent extracts only the essential information needed for intrusion detection - the count of messages from each component - while discarding unnecessary details such as message content analysis. By taking out only the message count rather than analyzing full message entropy, the system achieves detection capability with significantly reduced processing overhead.
Solution Approach 2:
The patent uses simple, computationally inexpensive counting operations instead of expensive entropy calculations. The counting unit generates simple numerical counts that are easy to process and evaluate, providing a cost-effective alternative to complex entropy-based analysis while maintaining intrusion detection effectiveness.
4Reliability
If message interval monitoring is used to detect attacks, then detection capability is provided, but the system requires monitoring of dozens of interval parameters for multiple message types
Solution Approach 1:
The patent merges the monitoring of multiple message types into a single unified counting process. Instead of maintaining separate interval parameters for dozens of message types, the system combines all message counting into a single counter per component, significantly simplifying parameter management while preserving the ability to detect intrusions affecting any message type.
Data Source
AI summary
A method for detecting the possibility of an intrusion into a bus system. The bus system includes a plurality of components which are able to transmit messages in the bus system. The method includes ascertaining a number of messages that are transmitted by a first component of the plurality of components in a specific time period; determining whether the number of messages in the specific time period satisfies a predefined first criterion; and detecting the possibility of an intrusion if the number of messages does not satisfy the predefined first criterion.