Onboard CAN Message Pattern Detection for Attack Identification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In onboard networks, particularly those following the CAN standard, distinguishing between normal and attack messages is challenging due to similarities in transmission timing and data values, leading to potential erroneous detection and increased probability of unauthorized control.
Innovation Solution
An unauthorized communication detection method that executes unauthorized activity detection and communication pattern determination on each message sent over the network, using patterns related to data value changes and communication timing, and employs statistical models like AR, ARMA, or HMM to predict message values and identify communication patterns for precise identification of attack messages.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional message comparison methods are used to detect attack messages on CAN network, then the detection process is simple, but the precision of distinguishing attack messages from normal messages deteriorates due to similarities in transmission timing and data values
Solution Approach 1:
The system performs preliminary identification of communication patterns by analyzing historical message data before actual attack detection occurs. Statistical models (AR, ARMA, HMM) are pre-trained on normal communication patterns, enabling the system to establish baseline expectations for message timing, frequency, and data value relationships. This preliminary preparation allows for more accurate real-time detection without increasing operational complexity.
Solution Approach 2:
The patent replaces traditional mechanical comparison methods with statistical modeling and pattern recognition algorithms. Instead of simple rule-based filtering, the system uses probabilistic models to analyze communication patterns, predict expected message characteristics, and identify deviations that indicate attacks. This substitution significantly improves detection precision while managing complexity through algorithmic approaches.
2Measurement precision
If statistical models like AR, ARMA, or HMM are used to analyze communication patterns, then the precision of attack message identification is improved, but the computational complexity and processing time increase
Solution Approach 1:
Statistical models are pre-trained offline on extensive datasets of normal communication patterns. The AR, ARMA, and HMM models learn expected timing intervals, message frequency distributions, and data value relationships during normal operation. This preliminary training phase separates model development from real-time detection, allowing complex computations to be performed beforehand rather than during critical message processing intervals.
Solution Approach 2:
The system applies statistical analysis selectively based on message characteristics and risk assessments. Not every message undergoes full statistical model evaluation - the system uses lightweight initial filtering and applies complex pattern recognition only when messages exhibit suspicious characteristics or when confidence levels require additional verification. This partial application reduces overall processing time while maintaining high detection precision for critical cases.
3Reliability
If comprehensive pattern analysis is performed on each message, then the reliability of unauthorized communication detection is improved, but the processing load and system resource consumption increase
Solution Approach 1:
The system implements a hierarchical detection approach where messages are processed at multiple levels of analysis. Lightweight rules-based filtering is applied first to quickly eliminate obviously normal messages. Only messages that pass initial filtering or exhibit suspicious characteristics undergo comprehensive statistical pattern analysis. This partial application of resource-intensive analysis maintains high detection reliability for critical messages while reducing overall energy consumption across the system.
Solution Approach 2:
The detection system continuously learns and adapts from incoming messages, automatically updating its understanding of normal communication patterns without external intervention. The statistical models are refined in-place as new data arrives, allowing the system to improve its detection reliability over time while processing only the incremental information needed for updates rather than re-analyzing entire message histories repeatedly.
Data Source
AI summary
An unauthorized activity detection method in an onboard network system. The detection method includes determining whether or not a message sent out onto the network is an attack message, saving information relating to the attack message in at least one memory in a case where the message is an attack message, identifying a communication pattern from information relating to the attack message, and determining whether or not the message matches a communication pattern. The determination of whether an attack message and determination of whether matching a communication pattern are executed on each of a plurality of messages received from the network. In the determining of whether an attack message executed on a message received after executing of determining of whether matching a communication pattern, results of the determination of whether an attack message that has already be executed are used.