In-Vehicle Network Unauthorized Frame Detection via Interval Variance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current in-vehicle network security measures struggle to accurately detect unauthorized frames in CAN communication networks, particularly when frames are transmitted within prescribed intervals, as existing methods fail to distinguish between normal and unauthorized data frames effectively.
Innovation Solution
An information processing method that involves receiving and recording data frames in a reception log, acquiring features from the distribution of reception intervals, and determining the presence of unauthorized frames using anomaly scores and variance calculations, allowing for more precise identification of unauthorized data frames.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If communication interval monitoring is used to detect unauthorized frames, then security detection capability is improved, but unauthorized frames transmitted within prescribed intervals cannot be detected
Solution Approach 1:
The patent changes the detection parameter from fixed communication interval to statistical distribution characteristics of reception intervals. By analyzing the variance and distribution patterns of multiple reception intervals, the system can detect unauthorized frames regardless of whether they are transmitted within or outside prescribed intervals, thus resolving the contradiction between detection accuracy and adaptability to different attack patterns
Solution Approach 2:
The patent applies partial action by focusing detection on the statistical distribution characteristics (variance, skewness) of reception intervals rather than monitoring every individual frame interval. This selective approach maintains high detection accuracy while reducing the complexity of monitoring all possible transmission patterns
2Device complexity
If simple communication interval checking is used, then detection process is simple, but detection precision is insufficient
Solution Approach 1:
The patent transforms the detection approach by changing from simple interval threshold checking to statistical parameter analysis (variance, skewness, kurtosis). This parameter transformation maintains relatively simple system architecture while significantly improving detection precision by capturing subtle anomalies in frame transmission patterns that simple threshold checks would miss
3Measurement precision
If reception interval distribution analysis is performed, then unauthorized frame detection accuracy is improved, but processing complexity increases
Solution Approach 1:
The patent extracts only the essential statistical features (variance, skewness, kurtosis) from the reception interval data, discarding unnecessary detailed information. This extraction approach maintains high detection accuracy by focusing on the most discriminative characteristics while reducing processing complexity by working with a limited set of statistical parameters rather than raw time-series data
Data Source
AI summary
An information processing method performed by an information processing system including a storage device to process a plurality of data frames flowing in an in-vehicle network including at least one electronic control unit includes a receiving step of sequentially receiving a plurality of data frames flowing in the in-vehicle network, a frame collection step of recording, in a reception log held in the storage device, reception interval information indicating reception intervals between the plurality of data frames as frame information, a feature acquisition step of acquiring, from the reception interval information, a feature relating to distribution of the reception intervals between the plurality of data frames, and an unauthorized data presence determination step of determining the presence/absence of an unauthorized data frame among the plurality of data frames.