In-Vehicle Network Fraud Detection via Arbitration Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing fraud detection methods for in-vehicle networks struggle to accurately determine whether a message is anomalous, particularly when the transmission period of normal messages increases in length due to disturbances on the CAN network bus.
Innovation Solution
A fraud detection method that determines whether a message is anomalous by checking if the transmission period is abnormal and if arbitration occurs during message transmission in the in-vehicle network system.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If message transmission period is monitored for fraud detection, then detection accuracy is improved, but false positives increase when transmission period increases due to network disturbances
Solution Approach 1:
The patent introduces arbitration detection as an intermediary mechanism to distinguish between legitimate period variations caused by network arbitration and actual fraud. By detecting whether arbitration occurred during message transmission, the system can mediate between the message period anomaly and the final fraud determination, preventing false positives while maintaining detection accuracy.
Solution Approach 2:
The patent changes the detection parameters from solely monitoring message period to a dual-parameter approach: message period plus arbitration status. This parameter change allows the system to account for legitimate variations in transmission timing due to arbitration while still detecting actual fraud, thereby improving both accuracy and reliability.
2Difficulty of detecting and measuring
If transmission period monitoring is used to detect anomalous messages, then fraud detection capability is improved, but normal messages may be incorrectly identified as anomalous due to period variations
Solution Approach 1:
Arbitration detection serves as an intermediary that provides context for message period variations. When arbitration is detected, it explains the period variation, preventing misclassification. This intermediary mechanism resolves the difficulty of detecting anomalies without reducing measurement precision.
Solution Approach 2:
The patent applies partial action by only flagging messages as anomalous when BOTH period anomaly AND lack of arbitration occur together. This partial approach (requiring multiple conditions) reduces false positives compared to monitoring period alone, while still maintaining detection capability for actual fraud.
3Reliability
If arbitration detection is added to message period monitoring, then false positive rate is reduced, but system complexity increases
Solution Approach 1:
The fraud detection device performs multiple functions: it monitors message periods, detects arbitration events, and integrates both signals for fraud determination. This multi-functionality allows a single device to handle both detection tasks without requiring separate systems, thereby limiting the increase in overall system complexity while improving reliability.
Solution Approach 2:
The patent merges message period monitoring and arbitration detection into a unified fraud determination process. By combining these functions in a single integrated system rather than separate independent systems, the increase in complexity is minimized while achieving improved determination reliability through the combined analysis.
Data Source
AI summary
A fraud detection method includes: determining whether a period of a message repeatedly transmitted in an in-vehicle network is anomalous; detecting whether arbitration occurs when the message is transmitted in the in-vehicle network; and determining that the message is an anomalous message, in the case where the period of the message is anomalous and no arbitration occurs when the message is transmitted in the in-vehicle network.