CAN Message Anomaly Detection via Content-Timing Pattern Matching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security measures are inadequate for protecting automotive computing systems, particularly in identifying potentially malicious messages sent via controller area networks (CAN), due to their unique differences from personal computer systems and limited adaptation of traditional security technologies.
Innovation Solution
A computer-implemented method and system for identifying suspicious CAN messages by monitoring and observing patterns in messages sent by electronic control units, detecting anomalies based on content and timing patterns that do not match predefined pairs of corresponding patterns, and determining messages as suspicious for potential malicious activity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional security technologies are adapted to protect automotive CAN systems, then security coverage is improved, but false positive rate increases due to fundamental differences between PC and automotive networks
Solution Approach 1:
The system changes the parameters of message analysis by observing both content patterns and timing patterns simultaneously. Legitimate CAN messages exhibit consistent timing intervals and content relationships, while malicious messages disrupt these patterns. The system dynamically adjusts detection thresholds based on learned normal behavior patterns, improving security coverage without increasing false positives.
Solution Approach 2:
The system performs preliminary observation and learning of legitimate message patterns before actual security detection begins. During an initial monitoring phase, the system establishes baseline content and timing patterns for each CAN device, enabling accurate future detection without requiring pre-programmed knowledge of specific attack signatures.
2Measurement precision
If comprehensive monitoring of all CAN messages is performed, then detection accuracy is improved, but computational resource consumption increases
Solution Approach 1:
The system extracts only the essential features from CAN messages for analysis: content patterns (specific data fields and their relationships) and timing patterns (intervals between messages). By focusing on these key extracted features rather than analyzing every bit of every message, the system maintains high detection accuracy while significantly reducing computational resource consumption.
Solution Approach 2:
The system applies partial monitoring by focusing attention on specific CAN devices and message types that are most critical to vehicle safety. Rather than uniformly analyzing all messages at maximum depth, the system adjusts monitoring intensity based on the importance of the affected systems, optimizing the balance between detection accuracy and resource usage.
Data Source
AI summary
The disclosed computer-implemented method for identifying suspicious controller area network messages may include (i) monitoring, for a predetermined period of time, messages sent by an electronic control unit that comprise a controller area network identifier for at least one controller area network device, (ii) observing, in the messages, a set of corresponding patterns that each comprise a content pattern and a timing pattern, (v) detecting a message that comprises the controller area network identifier, wherein a content pattern of the message and a timing pattern of the message do not match any pair of corresponding patterns in the set of corresponding patterns, and (vi) determining that the message is suspicious based at least in part on content pattern of the message and the timing pattern of the message not matching any pair of corresponding patterns in the set. Various other methods, systems, and computer-readable media are also disclosed.