Graph-Based State Space Model for IVN Anomaly Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing anomaly detection systems in In-Vehicle Networks (IVNs) face challenges in accurately distinguishing between normal and anomalous traffic patterns, particularly in detecting attacks that compromise Electronic Control Units (ECUs).
Innovation Solution
The proposed anomaly detection system constructs a state space model based on observed signal values and state transitions in IVN message sequences. This model is trained using both normal and synthetic anomalous message sequences, allowing it to identify probabilities of state transitions and detect anomalies by calculating distances or using probability heuristic methods.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional anomaly detection systems are used in IVNs, then they can detect anomalies, but they generate high false positives and fail to accurately distinguish between normal and anomalous traffic patterns
Solution Approach 1:
The system performs preliminary construction of a state space model using training message sequences before actual anomaly detection. The model pre-computes state transitions and probabilities based on normal IVN traffic patterns, enabling accurate real-time anomaly detection without generating false positives during operation.
Solution Approach 2:
The patent creates a simplified copy of IVN traffic behavior in the form of a state space model that captures essential state transitions and probabilities. This abstract representation allows the system to evaluate message sequences against learned patterns without processing entire raw traffic streams, improving detection accuracy while reducing false positives.
2Measurement precision
If a state space model is constructed from training message sequences, then anomaly detection accuracy improves, but the system complexity increases
Solution Approach 1:
The patent segments the IVN traffic analysis into discrete states and transitions, where each state represents a specific message sequence pattern and transitions represent state changes. This segmentation transforms complex continuous traffic data into manageable discrete components, reducing model construction complexity while maintaining high detection accuracy.
Solution Approach 2:
The system changes parameters by transforming raw message sequences into a normalized state space representation with discrete states and transition probabilities. This parameter transformation simplifies the model structure and reduces complexity while preserving the essential characteristics needed for accurate anomaly detection.
Data Source
AI summary
A method of operating an anomaly detection system includes receiving training message sequences corresponding to messages transmitted in an in-vehicle network (IVN), constructing, based on the training message sequences, a model that includes a plurality of states corresponding to observed signal values in the training message sequences and state transitions between respective states of the plurality of states, training the model by supplying, to the model, first messages sequences corresponding to the training message sequences and second message sequences not contained in the training message sequences, and, using the anomaly detection system, executing the model to identify anomalous message sequences transmitted in the IVN by receiving an IVN message sequence, outputting, from the model, a value based on state transitions between states of signals contained in the IVN message sequence, and outputting, based on the value, an indication of whether the IVN message sequence includes an anomalous message sequence.