CAN Intrusion Detection Using CRC Features for Low-Complexity Attack Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The CAN protocol in vehicle networks is vulnerable to attacks due to lack of mutual authentication, making vehicles susceptible to disruptions through various interfaces, and existing intrusion detection systems do not effectively utilize the CRC field as a feature for detection.
Innovation Solution
An intrusion detection system using cyclic redundancy check (CRC) that extracts CAN IDs and CRC fields from vehicle network data, employing a recurrent neural network (RNN) with long short-term memory (LSTM) to detect normal or attack data by training on padded feature information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If machine learning-based intrusion detection systems use complex features like CAN IDs and data payloads, then detection accuracy improves, but computational complexity increases
Solution Approach 1:
The patent extracts and utilizes the CRC field from CAN frames as a key feature for intrusion detection. By focusing on this specific extracted element rather than processing all CAN frame data, the system achieves high detection accuracy while reducing computational complexity. The CRC field serves as a compact representative feature that captures essential information for attack detection.
Solution Approach 2:
The patent transforms the CRC field values into normalized numerical parameters suitable for machine learning processing. By converting cryptographic checksum values into standardized numerical features and applying appropriate preprocessing, the system enables efficient computation while maintaining high detection accuracy through the informative content of the transformed parameters.
2Measurement precision
If intrusion detection systems process all CAN frame data, then detection comprehensiveness improves, but processing time increases
Solution Approach 1:
The system extracts only the CRC field and essential CAN ID information from complete CAN frames, processing a subset of data that contains sufficient information for effective intrusion detection. This selective extraction reduces processing time while maintaining detection comprehensiveness by focusing on the most informative elements.
Solution Approach 2:
The patent applies partial processing by analyzing only the CRC field and selected CAN frame elements rather than processing entire data payloads. This partial action approach achieves adequate detection performance with significantly reduced processing time, as the CRC field provides sufficient information for detecting anomalies and attacks.
3Reliability
If vehicle networks implement mutual authentication, then security improves, but system complexity increases
Solution Approach 1:
The patent introduces an intrusion detection system as an intermediary layer that monitors CAN traffic and detects attacks without requiring modification of existing ECU authentication mechanisms. This intermediary approach enhances network security by detecting malicious activities while avoiding the complexity of implementing mutual authentication across all vehicle components.
Solution Approach 2:
The system replaces complex mechanical authentication protocols with a software-based intrusion detection approach using machine learning analysis of CRC fields. This substitution achieves comparable or superior security through pattern recognition and anomaly detection, avoiding the complexity of implementing formal mutual authentication protocols in resource-constrained ECU environments.
Data Source
AI summary
An intrusion detection method performed by an intrusion detection system using CRC includes receiving in-vehicle CAN data in units of frame, generating first feature information by extracting a CAN ID from the in-vehicle CAN data in units of frame and performing zero padding, generating second feature information by extracting a CRC field from the in-vehicle CAN data in units of frame and performing the zero padding, training a learning model by setting the first feature information and the second feature information as input data and labeling, as output data, whether the CAN data is attack data or normal data, and detecting whether the CAN data is normal data or attack data by extracting a CAN ID and a CRC field from the received in-vehicle CAN data when training of the learning model is completed and inputting the CAN ID and the CRC field to the learning model.