CAN Attack Detection via Neural Network Bit Stream Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In-vehicle communication networks face challenges in effectively detecting and mitigating diverse and evolving hacking attacks, particularly due to limited resources and the potential for safety and privacy threats when hacking affects vehicle operations.
Innovation Solution
A method and apparatus for detecting CAN communication attacks using a neural network-based system that learns statistical characteristics of pre-defined CAN packets, allowing for adaptive detection of attacks without decoding the packets, by identifying CAN IDs, extracting bit streams, and determining attack presence based on neural network outputs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional decoding-based attack detection methods are used, then detection accuracy can be maintained, but computational complexity and processing time increase significantly
Solution Approach 1:
The patent extracts only the essential features from CAN packets (CAN ID and data field bit streams) without performing full decoding. This selective extraction approach maintains detection accuracy by focusing on the most relevant characteristics while avoiding the computational overhead of complete packet decoding and interpretation.
Solution Approach 2:
The patent creates a simplified binary representation model of CAN packets that captures the essential attack characteristics. Instead of working with complex decoded packet structures, the system uses binary bit streams that replicate the critical information needed for attack detection, significantly reducing computational complexity.
2Reliability
If full CAN packet decoding is performed for attack detection, then comprehensive analysis is achieved, but processing speed decreases
Solution Approach 1:
The system extracts only the critical bit streams from CAN packets (CAN ID and data fields) that are most indicative of attacks. By skipping the time-consuming full decoding process and focusing only on essential binary characteristics, the system achieves high processing speed while maintaining reliable attack detection.
3Measurement precision
If statistical analysis of all CAN packet data is performed, then detection precision improves, but resource consumption increases
Solution Approach 1:
The patent applies statistical analysis selectively to specific local regions of CAN packets (the data field bit streams) rather than analyzing the entire packet structure. This localized statistical approach maintains detection precision by focusing computational resources on the most informative segments while reducing overall resource consumption.
4Measurement precision
If manual configuration of detection parameters is required, then detection accuracy can be optimized, but ease of operation deteriorates
Solution Approach 1:
The system performs automatic learning and configuration of detection parameters through machine learning algorithms. The neural network automatically adjusts detection thresholds and parameters based on training data, eliminating the need for manual configuration while maintaining high detection accuracy. This self-service approach significantly improves ease of operation.
Data Source
AI summary
The present disclosure provides a vehicle controller area network (CAN) communication attack detection method and apparatus. The apparatus includes: a learning module, a profiling module, and a detection module. The learning module identifies a CAN identifier (ID) upon receiving a predefined CAN packet and generates learning statistical information expressed as bits with respect to a data field corresponding to the identified CAN ID. The profiling module maintains the learning statistical information received and a precollected attack type, and the detection module extracts a CAN ID and a bit stream of a data field from a real-time input CAN packet. In addition, the detection module configures a neural network by acquiring the learning statistical information from the profiling module, inputs the extracted bit stream to the configured neural network, and determines whether attack is detected, based on an output value of the neural network.