DBC-Based CAN Message Categorization for Sequence Intrusion Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing machine learning-based anomaly detection techniques in CAN systems are ineffective in detecting specific functional parts and learning similarities between them, particularly in the context of sequence-based intrusions in vehicle communication networks, due to their reliance on all data at once without considering specific functional categories.
Innovation Solution
A method utilizing a DBC file to categorize CAN messages and employ pre-trained neural network models with hidden layers to generate predictive data, compare it with actual data, and determine anomalies by calculating loss values and threshold comparisons, enabling detection of sequence-based intrusions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If existing machine learning-based anomaly detection techniques use all data at once without categorization, then the detection process is simple, but the ability to detect specific functional parts and learn similarities between them is poor
Solution Approach 1:
The patent divides CAN messages into multiple functional categories (e.g., powertrain, chassis, body systems) and creates separate detection models for each category. This segmentation allows the system to learn category-specific patterns and improve detection accuracy for particular functional domains while maintaining manageable model complexity through modular architecture.
Solution Approach 2:
The patent introduces category labels as an intermediary layer between raw CAN messages and the detection models. These category labels serve as mediators that organize and structure the input data, enabling models to learn hierarchical representations where category-specific features are extracted before final anomaly detection, thereby improving precision without proportionally increasing overall system complexity.
2Adaptability or versatility
If CAN systems are connected to outside environments through V2V and V2X, then communication functionality is improved, but security issues and intrusion risks arise
Solution Approach 1:
The patent implements pre-trained detection models for each functional category that are prepared in advance before actual security threats occur. These models learn normal communication patterns during training phases, enabling them to quickly identify deviations caused by intrusions or attacks when V2V/V2X communications are compromised, thus maintaining reliability while supporting enhanced communication capabilities.
Solution Approach 2:
The system continuously monitors CAN messages and provides feedback by comparing actual messages against predicted patterns from trained models. When anomalies are detected in V2V/V2X communications, the system generates alerts and can trigger safety responses, creating a closed-loop feedback mechanism that maintains system security while allowing flexible external communications.
Data Source
AI summary
[SUMMARY]A method of detecting a sequence-based intrusion by using a Database CAN (DBC) file, the method being performed by a computing device including a processor according to some exemplary embodiments of the present disclosure, includes: obtaining a first Controller Area Network (CAN) message generated from a CAN; determining the first CAN message as a first category among a plurality of categories based on a pre-stored DBC file; obtaining first predictive data from the first CAN message by using a pre-trained first neural network model, the pre-trained first neural network model corresponding to the first category and including a first hidden layer; and comparing the first predictive data and first actual data obtained based on the first CAN message to determine whether the first CAN message has an anomaly.