Onboard Network Attack Detection Using Communication Patterns
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting unauthorized messages in CAN networks struggle to accurately distinguish between normal and attack messages, particularly when transmission timings and data values are similar, leading to potential erroneous detection and increased probability of errors.
Innovation Solution
An unauthorized communication detection method that utilizes a system with a memory-based processing system to identify and analyze communication patterns, including data value and timing patterns, to determine whether individual messages are attack messages by comparing them against identified patterns using statistical models such as AR, ARMA, or Bayesian models, and storing ambiguous messages for later analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If existing detection methods are used to identify unauthorized messages, then detection capability is provided, but measurement precision deteriorates due to inability to accurately distinguish between normal and attack messages
Solution Approach 1:
The system performs preliminary actions by storing communication patterns and message data in advance before detection is needed. The pattern storage unit accumulates communication patterns from multiple ECUs, and the message storage unit stores message data for later analysis. This preliminary data accumulation enables more accurate detection by providing a reference basis for comparing incoming messages against established patterns, thereby improving measurement precision while reducing error probability through statistical analysis.
2Measurement precision
If communication patterns are analyzed to improve detection accuracy, then measurement precision is improved, but device complexity increases due to additional processing requirements
Solution Approach 1:
The detection system is segmented into distinct functional units: a communication pattern acquisition unit that collects data, a pattern storage unit that maintains communication patterns, a message storage unit that stores message data, and a determination unit that performs analysis. This segmentation allows each unit to specialize in a specific task, improving detection accuracy through focused processing while managing device complexity by distributing functions across modular components rather than requiring a monolithic complex system.
Data Source
Figure 1
Figure 2
Figure 3~5
AI summary
In an unauthorized activity detection method in an onboard network system, whether or not a message sent out onto the network is an attack message is determined, information relating to the attack message is saved in the memory in a case where the message is an attack message, a communication pattern is identified from information relating to the attack message, and whether or not the message matches a communication pattern is determined. The determination of whether an attack message and determination of whether matching a communication pattern are executed on each of a plurality of messages received from the network, and in the determining of whether an attack message executed on a message received after executing of determining of whether matching a communication pattern, results of the determination of whether an attack message that has already be executed are used.