Vehicle CAN Message Timing Analysis for ECU Attack Attribution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current intrusion-detection systems in vehicle CAN-bus networks cannot identify the source of cyber attacks effectively, as they lack an attacker-recognition system, and existing time-based techniques for message identification are vulnerable to cloning and manipulation.
Innovation Solution
A monitoring method utilizing statistical analysis of message arrival times to identify the electronic control unit transmitting a message, involving a learning phase to establish normal traffic patterns and anomaly detection through confidence interval calculations and vote-based classification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If time-based techniques are used to identify message sources, then message identification capability is improved, but vulnerability to cloning and manipulation increases
Solution Approach 1:
The patent changes the parameter being analyzed from simple message timing to statistical parameters (mean, variance, skewness, kurtosis) of message arrival times. This transformation makes the identification system more robust because statistical parameters are harder to clone or manipulate compared to simple timing information, while still maintaining the ability to identify message sources accurately.
Solution Approach 2:
The patent introduces statistical analysis as an intermediary layer between message transmission and identification. Instead of directly using timing information, the system uses statistical parameters as intermediaries that capture the temporal characteristics of legitimate nodes while being resistant to manipulation. This intermediary layer bridges the gap between timing-based identification and security requirements.
2Measurement precision
If statistical analysis of message arrival times is performed, then attacker recognition capability is improved, but computational complexity increases
Solution Approach 1:
The patent calculates only the necessary statistical parameters (mean, variance, skewness, kurtosis) required for identification, rather than performing complete statistical analysis. This partial action approach provides sufficient attacker recognition capability while limiting computational complexity to only the essential calculations needed for security identification.
Solution Approach 2:
The patent performs a learning phase before actual monitoring, where statistical parameters are calculated during normal operation to establish baseline behavior. This preliminary action allows the system to pre-compute and store reference statistical parameters, reducing the computational burden during real-time attack detection to simple comparisons rather than full statistical calculations.
3Reliability
If monitoring of all message identifiers is performed, then detection coverage is improved, but processing time increases
Solution Approach 1:
The patent segments the monitoring task by processing message identifiers in batches or groups rather than analyzing all messages sequentially. The learning phase groups statistical calculations by message identifier, allowing parallel processing and reducing overall processing time while maintaining comprehensive detection coverage across all identifiers.
Solution Approach 2:
The patent performs preliminary filtering and grouping of messages by identifier during the learning phase, organizing data structures in advance. This preliminary organization enables faster query and comparison operations during attack detection, reducing processing time while maintaining the ability to detect attacks on any message identifier in the system.
Data Source
AI summary
A method for protection from cyber attacks in a vehicle communication network including the steps of executing a protection and monitoring procedure comprising: a learning step that includes: acquiring sets ({right arrow over (V)}ID<sub2>k</sub2>) of values of times of arrival (TSIDk) of messages (MSG) exchanged on the network, ordered according to a respective message identifier (IDk), computing one or more statistical parameters(μIDk,sIDk2)of the sets of arrival-time values (TSIDk), and subsequently obtaining statistical parameters ({right arrow over (ω)}IDk) of confidence windows for one or more statistical parameters(μIDk,sIDk2)of the sets of arrival-time values (TS′IDk); and a subsequent classification and anomaly-detection step that includes: acquiring sets ({right arrow over (u)}ID<sub2>k</sub2>) of values of times of arrival (TS′IDk) at the device of messages (MSG′), computing corresponding one or more statistical parameters(μIDk′,sIDk2)of the sets of arrival-time values (TS′IDk) to obtain votes (V,W) of membership of the statistical parameters(μIDk′,sIDk2)of the sets of arrival-time values (TS′IDk) in confidence windows of the sets of arrival-time values (TS′IDk), and evaluating issuing of malicious-message alarms (AL) on the basis of the membership votes (V, W).