In-Vehicle Frame Extraction for Event-Induced Security Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing in-vehicle network detection techniques fail to identify illegal frames that do not follow a predefined cycle, particularly those caused by event occurrences such as door openings or closings, leading to potential security vulnerabilities.
Innovation Solution
An extraction device that sorts frames with the same identifier into those maintaining a cycle and those out of the cycle, and extracts features of bit changes in the data field related to event occurrences from the latter, enabling the detection of illegal frames.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If frame detection relies on cycle-based verification, then frames within the cycle can be detected accurately, but frames out of the cycle caused by event occurrences cannot be detected
Solution Approach 1:
The patent segments frame detection into two distinct pathways: cycle-based detection for periodic frames and event-based detection for aperiodic frames. The frame sorting unit divides frames into cyclic and non-cyclic categories, allowing each type to be detected using its appropriate method, thus resolving the contradiction between detection accuracy for cyclic frames and detection coverage for event-induced frames.
Solution Approach 2:
The patent transitions from a static cycle-based detection approach to a dynamic dual-mode detection system. The system adapts its detection method based on frame characteristics: using cycle verification for periodic frames and event-driven analysis for aperiodic frames. This dynamic adaptation enables the system to maintain high detection accuracy while expanding coverage to include event-induced frames.
2Device complexity
If only cyclic frames are monitored, then detection complexity remains low, but security vulnerabilities from undetected illegal frames increase
Solution Approach 1:
The detection system is segmented into multiple specialized units: a frame sorting unit that categorizes frames, a cycle rule determination unit for periodic frames, and an event rule determination unit for aperiodic frames. This segmentation allows each unit to focus on specific detection tasks, managing complexity while comprehensively addressing security threats from both cyclic and non-cyclic illegal frames.
Solution Approach 2:
The frame sorting unit acts as an intermediary that directs different types of frames to appropriate detection rules. It receives all frames, identifies whether they are cyclic or event-induced, and routes them to the corresponding determination unit. This intermediary structure organizes the detection process, managing system complexity while ensuring thorough security coverage.
3Measurement precision
If event-induced frames are excluded from detection, then false positives are reduced, but illegal frames masquerading as events remain undetected
Solution Approach 1:
The event rule determination unit implements feedback mechanisms by learning normal event-induced frame patterns from legitimate sources and using this knowledge to identify anomalies. The system continuously monitors event frames, establishes baseline behavior through the event rule unit, and flags deviations as potential security threats, thus reducing false positives while detecting malicious event masquerading.
Solution Approach 2:
The system performs preliminary analysis by extracting and storing event rules from legitimate event-induced frames before actual detection occurs. This preliminary action creates a reference database of normal event behavior, enabling the system to quickly compare incoming frames against established patterns and accurately distinguish between legitimate events and illegal frames exploiting event protocols.
Data Source
AI summary
An extraction device includes: at least one memory configured to store instructions; and at least one processor configured to execute the instructions to: sort each set of frames that have the same identifier associated with a node, into frames maintaining a cycle and frames out of the cycle; and extract, as an event rule, a feature of a bit change in a data field related to an event occurrence, from the frames that have the same identifier and are out of the cycle.