CAN Bus ECU Mapping Through Controlled Message Overlap
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional fingerprinting techniques for electronic control units (ECUs) in communication networks require prior knowledge of message identifications (MIDs), which is often unavailable, making it difficult to establish accurate mapping and initial training for intrusion detection systems (IDS) without proprietary information.
Innovation Solution
A method that forces retransmission of low-priority messages to overlap with high-priority messages, allowing the system to determine whether they originated from the same ECU, thereby establishing a mapping between ECUs and MIDs without prior knowledge of MID information, using a communication bus like CAN bus.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional fingerprinting techniques are used, then ECU identification can be performed, but prior knowledge of MIDs is required which is often unavailable
Solution Approach 1:
The system performs self-identification by autonomously generating MIDs through hashing of captured message frames. Instead of requiring external provision of MID-to-ECU mapping information, the intrusion detection system independently creates the mapping by hashing message identifiers from captured traffic and storing them in a data structure, enabling the system to service its own identification needs without proprietary data
Solution Approach 2:
A hash function serves as an intermediary that transforms captured message frames into unique MIDs. This intermediary mechanism bridges the gap between raw message traffic and ECU identification, converting unstructured message data into structured identifiers that can be mapped to ECUs without requiring pre-existing knowledge of the mapping relationships
2Measurement precision
If message overlap analysis is performed to determine ECU mapping, then accurate fingerprinting can be achieved, but message timing and priority coordination is required
Solution Approach 1:
The system employs periodic message transmission with ECUs sending messages at regular intervals. By analyzing the periodic nature of message streams and their temporal patterns, the system can identify which messages originate from the same ECU based on consistent timing relationships, enabling accurate mapping without complex coordination protocols
Solution Approach 2:
The system performs preliminary capture and analysis of message timing patterns before establishing final ECU mappings. By pre-analyzing the temporal characteristics of message traffic and identifying periodic patterns, the system prepares the necessary data structures and timing information in advance, simplifying the subsequent mapping process
Data Source
Figure 1
Figure 2
Figure 3A~3B
AI summary
Systems, apparatuses, and methods to establish a mapping between message identifications for messages transmitted on a communication bus and electronic control units transmitting the messages is provided. In particular, retransmission of a low priority message onto the bus is forced such that the retransmitted low priority message overlaps with a higher priority message to determine whether the messages originated from the same ECU.