CAN Bus Anomaly Detection via Probability Model Adaptation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Controller Area Network (CAN) buses in vehicles are vulnerable to intrusions, which can compromise vehicle functions and adapt over time, necessitating a robust anomaly detection system to identify and address potential threats.
Innovation Solution
A method and system for anomaly detection in CAN buses that involves receiving binary messages, generating feature vectors, adapting a probability model, and comparing it to a universal background model to determine network anomaly levels, with the ability to fuse anomaly levels from multiple vehicles to identify fleet-wide anomalies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional anomaly detection methods are used on CAN buses, then the system complexity is low, but the detection precision and reliability are insufficient to identify adaptive intrusion techniques
Solution Approach 1:
The detection system segments the CAN bus traffic into multiple feature dimensions including message frequency, identifier distribution, data content patterns, and temporal characteristics. This segmentation allows the system to analyze specific aspects of network behavior independently, improving detection precision without requiring a monolithic complex system.
Solution Approach 2:
The patent transforms the anomaly detection problem from traditional single-dimensional threshold checking to multi-dimensional probability space analysis. By mapping CAN bus messages into feature vectors with multiple dimensions (message rate, identifier entropy, data payload patterns), the system achieves higher detection precision through probabilistic modeling in extended dimensional space.
2Adaptability or versatility
If a universal background model is used for all vehicles, then the system has high adaptability to different intrusion techniques, but the model training requires large amounts of data and time
Solution Approach 1:
The system performs preliminary action by pre-training a universal background model using aggregated data from multiple vehicles during manufacturing or initial deployment phases. This pre-trained model captures general intrusion patterns and can be rapidly adapted to individual vehicles through transfer learning, reducing the time required for on-vehicle model training while maintaining high adaptability to diverse intrusion techniques.
Solution Approach 2:
The patent implements a universal background model that serves multiple vehicles and detects various types of intrusion techniques across different vehicle models. This multi-functional model is trained on diverse CAN bus data from multiple sources, enabling it to generalize across different vehicle architectures and intrusion methods, thereby achieving high adaptability without requiring separate models for each vehicle.
3Speed
If real-time anomaly detection is implemented, then the response time to intrusions is reduced, but the computational load and energy consumption increase
Solution Approach 1:
The system applies partial action by performing lightweight anomaly detection continuously in real-time using a compressed version of the probability model, and only triggers full probabilistic analysis when preliminary indicators suggest potential anomalies. This approach maintains fast response time for immediate detection while reducing overall computational load and energy consumption by avoiding exhaustive analysis of every message.
Solution Approach 2:
The patent replaces computationally intensive mechanical probability calculations with optimized algorithms and approximate computing techniques. By substituting full probabilistic inference with lighter computational operations for routine message validation, the system achieves real-time detection speed while significantly reducing energy consumption, reserving full computational power only for suspected anomaly events.
4Reliability
If fleet-wide anomaly aggregation is implemented, then the overall security monitoring capability is improved, but the data communication overhead and processing complexity increase
Solution Approach 1:
The system extracts only the essential anomaly indicators and aggregated statistics from individual vehicle data before transmitting to the fleet server. By taking out only the critical information (anomaly scores, detected pattern types, confidence levels) rather than transmitting complete raw message streams, the system improves fleet-wide security monitoring reliability while minimizing data communication overhead and information loss.
Data Source
AI summary
An anomaly detector of a Controller Area Network (CAN) bus performs analysis on messages received from the CAN bus to determine if the messages are anomalous. The anomaly detector may be implemented on a vehicle by an Electronic Control Unit (ECU). The anomaly detector may extract a batch of feature vectors for binary messages received from the CAN bus. The anomaly detector then performs a model adaption to adapt a previous probability model with the batch of feature vectors. The adapted probability model is then compared with a universal background model to determine a network anomaly level.