In-Vehicle Attack Path Estimation Across ECUs and External Interfaces

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing technologies struggle to accurately estimate the attack path, including the entry point and attack target, in cyber attacks on in-vehicle networks, due to issues with anomaly detection results containing undetected anomalies and false detections.

Innovation Solution

An attack analysis device that utilizes in-vehicle network information and anomaly detection information to estimate the attack path, incorporating an entry point estimator, attack target estimator, and an outputter to provide a detailed analysis.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If anomaly detection is performed on in-vehicle network nodes, then attack detection capability is improved, but false detections and undetected anomalies increase

Engineering Contradiction:
Improveattack detection capabilityVSAvoidanomaly detection accuracy
Core Design Contradiction:
ReliabilityVSMeasurement precision

Solution Approach 1:

The patent introduces an attack path estimator as an intermediary component that processes anomaly detection results from multiple nodes. Instead of directly acting on individual anomaly detections, the estimator综合分析anomaly information from multiple ECUs and communication interfaces to determine the actual attack path, thereby reducing false detections and improving overall detection accuracy

Inventive Principle:
Principle #24Intermediary (Mediator)

Solution Approach 2:

The system implements feedback by using anomaly detection results to update and refine attack path estimation. The estimated attack paths are fed back to improve future anomaly detection and analysis, creating a continuous improvement loop that enhances detection precision while maintaining comprehensive monitoring

Inventive Principle:
Principle #23Feedback

2Measurement precision

If attack path estimation is performed using anomaly detection information, then analysis accuracy is improved, but processing complexity increases

Engineering Contradiction:
Improveattack path estimation accuracyVSAvoidanalysis processing complexity
Core Design Contradiction:
Measurement precisionVSDevice complexity

Solution Approach 1:

The patent segments the attack analysis process into distinct functional modules: anomaly detection at individual nodes, attack path estimation using multiple ECUs and communication interfaces as separate analysis units, and result synthesis. This segmentation allows each module to focus on specific tasks, improving accuracy while managing complexity through modular processing

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The attack path estimator serves multiple functions simultaneously: it processes anomaly detection information, estimates attack paths, identifies entry points, and determines target ECUs. This multi-functionality consolidates what would otherwise require multiple separate systems, reducing overall processing complexity while maintaining high estimation accuracy

Inventive Principle:
Principle #6Universality (Multi-functionality)

3Manufacturing precision

If detailed attack path analysis is provided including entry point and target identification, then security analysis quality is improved, but processing time increases

Engineering Contradiction:
Improvesecurity analysis qualityVSAvoidanalysis processing time
Core Design Contradiction:
Manufacturing precisionVSLoss of time

Solution Approach 1:

The system performs preliminary actions by pre-establishing the relationships between ECUs, communication interfaces, and potential attack vectors. When anomalies are detected, the attack path estimator can quickly reference pre-computed information to rapidly generate detailed attack path analysis including entry points and targets, thereby maintaining high analysis quality while reducing processing time

Inventive Principle:
Principle #10Preliminary action

Data Source

PatentEP4250151B1Attack analysis device, attack analysis method, and program
Publication Date: 2025.04.02 PANASONIC INTELLECTUAL PROPERTY CORP OF AMERICA
  • EP4250151B1 patent drawingFigure 1
  • EP4250151B1 patent drawingFigure 2
  • EP4250151B1 patent drawingFigure 3

AI summary

An attack analysis device (10) includes: an obtainer (11) that obtains in-vehicle network information indicating a configuration of an in-vehicle network (20) including a plurality of external communication interfaces (21) and a plurality of control Electronic Control Units (ECUs) (22), and anomaly detection information indicating a result of detecting an anomaly in at least one node in the in-vehicle network (20); an attack path estimator (12) that, based on the in-vehicle network information and the anomaly detection information, estimates an attack path in an attack on the in-vehicle network (20), the attack path including an entry point indicating an external communication interface (21) that is a point of intrusion into the in-vehicle network (20) in the attack and an attack target indicating a control ECU (22) that is a target of the attack; and an outputter (13) that outputs the attack path.