Vehicle ECU Intrusion Detection Using Frame Attributes and Status
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing intrusion detection systems fail to accurately detect unauthorized communication in vehicle ECUs due to spoofing or tampering, as they rely solely on frame count thresholds, missing unauthorized frames transmitted within normal cycles.
Innovation Solution
An intrusion detection device that acquires frame attributes and communication control status information to determine abnormality by combining these factors, using a frame transmission determination unit and status determination unit to identify unauthorized communication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If frame count threshold is used for intrusion detection, then detection simplicity is improved, but detection accuracy deteriorates
Solution Approach 1:
The patent transitions from single-dimensional frame count monitoring to multi-dimensional analysis by incorporating communication control status (active/inactive states) and frame attributes (ID, source/destination). This dimensional expansion enables detection of unauthorized frames even when transmission frequency appears normal, resolving the contradiction between simple threshold-based detection and accurate multi-factor analysis.
Solution Approach 2:
The detection system combines multiple detection factors (frame count, communication control status, frame attributes) into a composite detection mechanism. By integrating these diverse data types, the system achieves both operational simplicity through unified processing and high accuracy through comprehensive analysis, eliminating the limitations of single-factor threshold detection.
2Measurement precision
If communication control status is monitored, then detection accuracy is improved, but device complexity increases
Solution Approach 1:
The communication control status monitoring mechanism serves multiple detection purposes simultaneously: identifying inactive ECUs transmitting frames, detecting unauthorized communication, and determining abnormal states. This multi-functionality allows the system to achieve high detection accuracy without proportionally increasing complexity, as a single monitoring approach addresses multiple detection needs.
Solution Approach 2:
The system introduces communication control status information as an intermediary factor that mediates between frame transmission observation and abnormality determination. This intermediary enables accurate detection by providing contextual information about ECU states, allowing the system to distinguish between normal and unauthorized transmission patterns without requiring overly complex analysis mechanisms.
3Measurement precision
If multiple detection factors are analyzed, then detection accuracy is improved, but processing time increases
Solution Approach 1:
The system performs preliminary classification of ECUs into active and inactive states based on communication control status before conducting detailed frame analysis. This preliminary action filters the detection scope, allowing the system to focus computational resources only on frames from inactive ECUs or frames with suspicious attributes, thereby reducing overall processing time while maintaining high accuracy.
Solution Approach 2:
The detection process is segmented into distinct analysis stages: communication control status verification, frame attribute analysis, and abnormality determination. By dividing the complex multi-factor analysis into manageable segments, the system processes multiple factors efficiently without excessive time consumption, as each segment can be handled independently and results are combined for final determination.
Data Source
AI summary
Provided are an intrusion detection device and a detection method that enable detection of unauthorized communication to be performed more accurately. This intrusion detection device includes a communication unit that transmits and receives a frame to and from an in-vehicle electronic device; an attribute acquisition unit that acquires an attribute of the frame; a status acquisition unit that acquires communication control status information indicating a communication control status of the frame by the in-vehicle electronic device; and an abnormality detection unit that detects an abnormality of the in-vehicle electronic device on the basis of the attribute and the communication control status. Even when the number of frames transmitted per unit time is equal to or less than a predetermined value, it is possible to determine an abnormality of the in-vehicle electronic device according to the communication control status of the ECU 20 constituting the transmission source of the frame and the attributes of the frame.