Network Frame Anomaly Sensing With Payload-Level Attack Localization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting anomalous frames in in-vehicle networks, such as CAN, do not provide detailed information necessary for quick response to anomalies, leaving vehicles vulnerable to attacks.
Innovation Solution
An anomaly detection method that determines anomalous frames by calculating the difference in data distribution between observed and reference frames, outputs anomalous payload parts, and classifies anomaly types and levels based on payload part lengths, enabling rapid and appropriate responses.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If anomaly detection is performed using existing methods (PTL 1 and PTL 2), then the degree of anomaly can be calculated, but detailed information for quick response to anomalies is not provided
Solution Approach 1:
The patent segments the anomaly detection process into multiple components: (1) extracting multiple types of features from communication frames (header features, payload features, timing features), (2) calculating anomaly scores for each feature type separately, and (3) providing detailed breakdown information for each anomalous feature. This segmentation allows both precise detection and detailed information provision simultaneously.
2Measurement precision
If comprehensive feature extraction is performed to provide detailed anomaly information, then response accuracy is improved, but processing complexity increases
Solution Approach 1:
The processing system is segmented into modular components: feature extraction modules for different frame types, anomaly calculation modules for each feature category, and information generation modules. This modular segmentation reduces overall system complexity while maintaining comprehensive analysis capability.
Solution Approach 2:
The patent creates a universal anomaly detection framework that handles multiple types of communication frames (CAN, LIN, FlexRay, Ethernet) using the same core processing logic. The feature extraction and anomaly calculation mechanisms are designed to be frame-type agnostic, reducing the need for separate processing paths for each protocol.
3Measurement precision
If detailed anomaly analysis is performed on all frames, then detection accuracy is improved, but processing time increases
Solution Approach 1:
The system performs partial detailed analysis only on frames that exhibit anomalous characteristics in preliminary checks. Normal frames undergo minimal processing, while only suspicious frames receive comprehensive feature extraction and detailed anomaly analysis. This selective approach maintains high detection accuracy for anomalous frames while reducing overall processing time.
Solution Approach 2:
Different levels of analysis are applied to different frames based on their characteristics. Frames with normal feature patterns receive basic processing, while frames showing deviation from normal patterns receive intensive detailed analysis. This local quality approach optimizes the balance between detection accuracy and processing speed.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
In an anomaly detection method that determines whether each frame in observation data constituted by a collection of frames sent and received over a communication network system is anomalous, a difference between a data distribution of a feature amount extracted from the frame in the observation data and a data distribution for a collection of frames sent and received over the communication network system, obtained at a different timing from the observation data, is calculated. A frame having a feature amount for which the difference is predetermined value or higher is determined to be an anomalous frame. An anomaly contribution level of feature amounts extracted from the frame determined to be an anomalous frame is calculated, and an anomalous payload part, which is at least one part of the payload corresponding to the feature amount for which the anomaly contribution level is at least the predetermined value, is output.