CAN Reference Message Selection for Unauthorized Communication Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In onboard networks, particularly those using the CAN standard, distinguishing between normal and attack messages is challenging due to close transmission timing and data value similarities, leading to increased erroneous detection probabilities.
Innovation Solution
An unauthorized communication detection method that identifies communication patterns from attack messages, determines message matching, and selects a reference message for precise detection, using statistical models like AR, ARMA, or HMM to predict data values and timing patterns, ensuring accurate differentiation between normal and attack messages.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If message transmission timing and data values are made similar between normal and attack messages, then attack detection becomes more difficult, but this increases the probability of erroneous detection
Solution Approach 1:
The system performs preliminary learning of normal communication patterns during a normal period before attacks occur. By establishing baseline communication patterns (timing, data values, frequencies) in advance, the system can later compare actual messages against these pre-established norms to detect deviations indicating attacks, thereby improving detection accuracy without increasing false positives
Solution Approach 2:
The system continuously monitors communication patterns and provides feedback by comparing actual messages against learned normal patterns. When deviations are detected, the system identifies them as potential attacks while maintaining the ability to distinguish genuine attacks from normal variations, thus resolving the contradiction between detection sensitivity and false positive rate
2Measurement precision
If communication pattern identification is performed using statistical models, then detection precision is improved, but computational complexity increases
Solution Approach 1:
The system employs statistical models (AR, ARMA, HMM) to analyze communication parameters such as timing intervals, data values, and transmission frequencies. By transforming raw communication data into statistical parameters and comparing them against learned patterns, the system achieves high detection precision while managing computational complexity through parameter transformation rather than raw data analysis
3Measurement precision
If reference message selection is made more selective, then detection accuracy is improved, but the time required for reference message identification increases
Solution Approach 1:
The system pre-identifies and stores candidate reference messages during the normal learning period. By preparing potential reference messages in advance and organizing them for quick retrieval, the system can rapidly select appropriate references during attack detection without sacrificing accuracy, thus resolving the time-accuracy tradeoff
Data Source
AI summary
A method, system, and medium used in unauthorized communication detection in an onboard network system having electronic control units connected to a network include: identifying, from information relating to an attack message on the onboard network system, a communication pattern indicating features of the attack message; determining whether a candidate reference message matches the communication pattern; and determining a reference message used as a reference in determining whether or not a message sent out onto the network is an attack message, using results of the determining of whether or not the candidate reference message matches the communication pattern identified in the identifying operation.