Dual Counter DoS Detection in ECU Relay
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional receiving devices face challenges in promptly detecting denial of service (DoS) attacks, where unwanted data is continuously transmitted at short intervals, leading to impaired functionality and increased processing load, which can result in unintended data processing and transmission.
Innovation Solution
A receiving device with a dual counter system, where a first counter increments if the received data exceeds a first threshold and a second counter increments if it exceeds a higher threshold, allowing for adaptive monitoring cycles to quickly detect DoS attacks while minimizing processing load by adjusting the monitoring frequency based on attack likelihood.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If the monitoring cycle is set to a short cycle to promptly detect DoS attacks, then the detection speed is improved, but the processing load of the microcomputer increases
Solution Approach 1:
The patent divides the monitoring system into two independent counter mechanisms: a first counter that monitors at a long cycle with low processing load, and a second counter that monitors at a short cycle but only when triggered. This segmentation allows the system to maintain low average processing load while enabling rapid detection when DoS attacks occur.
Solution Approach 2:
The monitoring cycle is made dynamic rather than fixed. The system automatically switches between long cycle (normal operation) and short cycle (attack detection) based on the state of the first counter. This dynamic adjustment optimizes both detection speed and processing load by adapting to actual network conditions.
2Productivity
If the receiver processes all received data normally, then data processing completeness is improved, but the receiving device function is impaired during DoS attacks
Solution Approach 1:
The system implements feedback through the two-counter monitoring mechanism that continuously tracks data reception patterns. When the feedback from the first counter indicates abnormal patterns (DoS attack suspected), the system automatically adjusts its behavior to discard suspicious data, thereby protecting device function while maintaining normal processing during legitimate operations.
3Device complexity
If the first counter monitors continuously at long cycle, then the processing load is reduced, but the DoS attack detection is delayed
Solution Approach 1:
The first counter performs preliminary monitoring at a long cycle to detect potential DoS attack patterns early. When abnormal patterns are detected, it triggers the second counter to begin intensive monitoring, thereby preparing the system for rapid detection without continuously bearing the high processing load of short-cycle monitoring.
Solution Approach 2:
The first counter acts as an intermediary that filters and pre-processes monitoring data before triggering the second counter. This intermediary mechanism reduces the frequency of second counter activation, thereby reducing overall processing load while maintaining the capability for rapid detection when needed.
Data Source
AI summary
In a relay device, a transmitting/receiving unit of an ECU relay receives data. A first counter value is incremented if an amount of data received by the transmitting/receiving unit per unit time exceeds a first threshold. A second counter value is incremented if the amount of data received by the transmitting/receiving unit per unit time exceeds a second threshold. The second threshold is greater than the first threshold. A control unit of a bus relay repeatedly monitors the first counter value. If the first counter value is incremented, the control unit shortens a cycle with which the second counter value is monitored.