In-Vehicle Anomaly Detection via Data Distribution Comparison
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting anomalous frames in in-vehicle communication networks, such as those using CAN protocol, do not provide detailed information necessary for quick response to anomalies, leaving vehicles vulnerable to improper control by attackers.
Innovation Solution
An anomaly detection method and device that determine if frames in a communication network are anomalous by calculating differences in data distributions of feature amounts between observed and reference data, outputting specific anomalous payload parts and contributing levels to aid in rapid response.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If anomaly detection is performed using existing methods (PTL 1 and PTL 2), then the degree of anomaly can be calculated, but detailed information for quick response is not provided
Solution Approach 1:
The anomaly detection system segments the anomaly detection process into multiple components: (1) collecting frame data from the communication network, (2) extracting feature amounts from frames, (3) calculating data distribution of feature amounts, (4) comparing with reference models to detect anomalies, and (5) identifying specific anomalous payload parts. This segmentation allows the system to provide both anomaly detection and detailed anomaly information simultaneously.
Solution Approach 2:
The patent transitions from one-dimensional anomaly scoring (existing methods) to multi-dimensional anomaly analysis by examining data distributions across multiple feature amounts and identifying specific payload parts. This dimensional expansion provides both the degree of anomaly and detailed information about which payload parts are anomalous, resolving the information loss problem.
2Loss of information
If detailed analysis of each frame is performed to identify anomalous parts, then quick response information is provided, but processing complexity increases
Solution Approach 1:
The system performs preliminary actions by pre-collecting frame data during normal operation and pre-calculating reference data distributions before anomaly detection is needed. When an anomaly occurs, the system compares current frame data against these pre-established references, significantly reducing processing complexity during critical anomaly response scenarios while still providing detailed anomaly part information.
Solution Approach 2:
The patent extracts only the essential feature amounts from frame data that are relevant for anomaly detection, rather than analyzing all possible frame attributes. By selectively extracting and analyzing specific payload parts and their corresponding feature amounts, the system provides detailed anomaly information without proportionally increasing processing complexity.
3Loss of time
If data distribution is calculated for real-time observation data, then anomaly detection is timely, but processing time and computational load increase
Solution Approach 1:
The system applies partial action by calculating data distributions only for selected feature amounts that are most relevant for anomaly detection, rather than processing all possible frame attributes. This selective approach enables timely anomaly detection with reduced computational load and energy consumption, as the system focuses resources on the most critical analysis tasks.
Data Source
AI summary
In an anomaly detection method that determines whether each frame in observation data constituted by a collection of frames sent and received over a communication network system is anomalous, a difference between a data distribution of a feature amount extracted from the frame in the observation data and a data distribution for a collection of frames sent and received over the communication network system, obtained at a different timing from the observation data, is calculated. A frame having a feature amount for which the difference is predetermined value or higher is determined to be an anomalous frame. An anomaly contribution level of feature amounts extracted from the frame determined to be an anomalous frame is calculated, and an anomalous payload part, which is at least one part of the payload corresponding to the feature amount for which the anomaly contribution level is at least the predetermined value, is output.