Dynamic Threshold Adjustment for In-Vehicle Bus Attack Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting cyber attacks on in-vehicle networks face challenges in accurately distinguishing between normal frame delays due to congestion and actual attack frames, leading to potential false detections.
Innovation Solution
An abnormality detection apparatus and method that adjusts the threshold for determining data frame reception cycles based on the bus load value, calculating a congestion degree, to prevent false positives during congestion while ensuring accurate detection of attack frames when the bus is not congested.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If a fixed threshold is used for determining reception cycle, then the detection method is simple, but false detection occurs during bus congestion
Solution Approach 1:
The patent applies dynamics by making the reception cycle threshold dynamic rather than fixed. The threshold is adjusted based on the bus load value, which varies with network conditions. When bus load is high, the threshold is increased to accommodate delayed frames, and when bus load is low, the threshold is decreased for stricter detection, thus resolving the contradiction between simplicity and reliability.
Solution Approach 2:
The patent changes the parameter of the reception cycle threshold based on the bus load value. By introducing a variable threshold that adapts to network congestion levels, the system maintains detection simplicity while improving reliability under varying bus conditions.
2Measurement precision
If a strict threshold is used for reception cycle, then attack frames are detected accurately, but normal frames during congestion are falsely detected as attacks
Solution Approach 1:
The system dynamically adjusts the reception cycle threshold based on real-time bus load measurements. During congestion, the threshold is relaxed to prevent false detection of delayed normal frames, while during normal operation, the threshold is strict for accurate attack detection, thus resolving the contradiction between precision and reliability.
Solution Approach 2:
The patent changes the threshold parameter adaptively based on bus load conditions. This parameter change allows the system to maintain high detection precision when the bus is clear while reducing false positives during congestion, effectively resolving the contradiction.
3Reliability
If a loose threshold is used for reception cycle, then false detection is reduced during congestion, but attack frames may be missed
Solution Approach 1:
The dynamic threshold adjustment based on bus load resolves this contradiction by applying loose thresholds only when congestion is detected (high bus load), and strict thresholds when the bus is clear (low bus load). This conditional adaptivity maintains both reliability and precision.
Solution Approach 2:
The patent implements parameter changes in the threshold based on bus load conditions, ensuring that detection precision is maintained during normal operation while false detection is reduced during congestion through adaptive parameter adjustment.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
An abnormality detection apparatus (100) is provided that is connected to a bus through which a data frame is transmitted at a predetermined cycle, and that detects an attack on equipment connected to the bus. The abnormality detection apparatus (100) includes: a frame reception unit (121) receiving the data frame transmitted through the bus; an attack detection unit (117) determining whether or not a reception cycle of a check target data frame is within a normal range by using a threshold indicating a normal range, and detecting presence or absence of an attack based on a determination result; a bus load calculation unit (114) calculating a bus load value indicating a congestion degree in the bus based on contents of the data frame that the frame reception unit receives; and a reception cycle threshold calculation unit (115) deciding the threshold according to the bus load value that the bus load calculation unit calculates.