Relay Device Fuzzing Detection via Decoy Operations
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Built-in information processing devices in automobiles and factory systems face challenges in dealing with fuzzing attacks, as existing measures can cause unintended device disablement, are ineffective against unknown attacks, and prompt reporting of fuzzing is impractical due to remote monitoring limitations and potential attacker control.
Innovation Solution
A relay device with a receiving unit, fuzzing detection unit, disguised operation decision unit, and instruction generation unit to detect illegitimate instructions and execute decoy operations that do not affect essential functions, making it difficult for attackers to discover vulnerabilities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of time
If function limitation is applied when fuzzing is detected, then vulnerability discovery is delayed, but user safety may be compromised due to unexpected device disablement
Solution Approach 1:
The relay device acts as an intermediary between the fuzzing attack and the information processing device. It detects illegitimate instructions and generates decoy operations that mimic legitimate behavior, preventing direct interaction between the attacker and the target device while delaying vulnerability discovery without compromising user safety
Solution Approach 2:
The relay device creates copies of legitimate instructions and operations. When illegitimate instructions are detected, it generates decoy operations that replicate the appearance of normal device behavior, causing attackers to waste time analyzing false positives while the actual device continues operating safely
2Speed
If remote monitoring is implemented for prompt reporting, then attack response time is reduced, but monitoring coverage is limited in remote regions and offline states
Solution Approach 1:
The information processing device is equipped with autonomous fuzzing detection capabilities through the relay device. It can independently detect illegitimate instructions and execute decoy operations without requiring external monitoring or reporting, enabling self-protection in offline and remote regions while maintaining rapid response to attacks
3Measurement precision
If signature-based intrusion detection is used, then known attacks are detected accurately, but unknown attacks cannot be dealt with
Solution Approach 1:
The relay device changes the parameter of detection from signature matching to behavioral analysis. Instead of checking for known attack patterns, it monitors the characteristics of instructions (frequency, timing, content variations) and detects anomalies that indicate fuzzing attacks, enabling detection of both known and unknown attack types
4Adaptability or versatility
If anomaly-based intrusion detection is used, then unknown attacks are detected, but misdetection occurs when device information changes
Solution Approach 1:
The relay device dynamically adapts its detection parameters based on the specific device being protected. It learns the normal operational characteristics of each device and adjusts its anomaly detection thresholds accordingly, maintaining high detection accuracy for unknown attacks while minimizing false positives when device information changes through software installation or configuration
Data Source
AI summary
The present invention provides a relay device including: a receiving unit that receives instructions; a fuzzing detection unit that detects an illegitimate instruction among the instructions received by the receiving unit; a disguised operation decision unit that decides a disguised operation corresponding to the illegitimate instruction detected by the fuzzing detection unit; and an instruction generation unit that generates an instruction corresponding to the disguised operation decided by the disguised operation decision unit.