CAN Network Attack Detection via Predicted Message Count Comparison
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In CAN systems, the accuracy of attack detection is compromised due to delayed message transmission timing, leading to potential false negatives where normal messages are misidentified as malicious.
Innovation Solution
An attack detection device that predicts the number of messages to be received within a specified monitor range based on transmission cycles and compares this with the actual count, using a processor to detect attacks by resetting predicted values and count values when specified conditions are met.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Stability of the object's composition
If message transmission priority is assigned based on ID to avoid collisions, then message collision is reduced, but transmission timing delay occurs for low-priority messages
Solution Approach 1:
The system pre-calculates expected arrival times of messages based on their transmission cycles and priority levels before actual reception occurs. This preliminary timing information is stored and used to compare against actual arrival times, enabling the detection system to account for predictable delays due to priority-based scheduling without false positives.
2Reliability
If expected arrival time comparison is used to detect malicious messages, then attack detection capability is provided, but false detection occurs when normal messages are delayed
Solution Approach 1:
The system changes the detection parameter from a fixed time-window approach to a dynamic expected arrival time approach. By calculating when messages should arrive based on their transmission cycles and comparing actual arrivals against these dynamic expectations, the system maintains high detection accuracy while accommodating normal timing variations and delays.
3Difficulty of detecting and measuring
If monitoring is performed for each message arrival time, then malicious messages can be detected, but detection accuracy decreases when transmission timing varies
Solution Approach 1:
The system establishes a feedback mechanism where actual message arrival times are continuously compared against pre-calculated expected arrival times. This feedback loop allows the system to learn and adapt to normal timing variations while maintaining the ability to detect anomalies that deviate from expected patterns, thereby preserving detection accuracy despite timing variations.
Data Source
AI summary
An attack detection device includes: a receiver configured to receive messages that are periodically transmitted from a communication device in a network; and a processor. The processor predicts a number of messages to be received by the receiver in a specified monitor range based on a transmission cycle of the messages so as to generate a predicted value. The processor counts a number of messages received by the receiver in the specified monitor range so as to generate a count value. The processor detects an attack in the network according to a result of a comparison between the predicted value and the count value.