Software Intrusion Detection via Activity Threshold Monitoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting hacking in electronic devices, such as those in vehicles, are inadequate as they rely solely on monitoring communications and cannot detect unauthorized modifications or software installations that do not cause detectable changes in communication patterns.
Innovation Solution
An intrusion detection module that determines an expected activity value for software applications and monitors current activity to initiate security actions when the current value exceeds a threshold, including halting execution, disconnecting communications, or deleting the software, thereby addressing undetectable hacking attempts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If communication monitoring is used to detect hacking, then detection capability for communication-based attacks is improved, but detection capability for non-communication-based hacking is lost
Solution Approach 1:
The patent transitions from monitoring only communication dimensions (network traffic, messages) to adding internal system activity dimensions (CPU usage, memory usage, power consumption). This multi-dimensional approach allows detection of hacking attempts that do not manifest in communication patterns but do affect system resource consumption.
Solution Approach 2:
The intrusion detection system is designed to monitor multiple types of activities simultaneously - communication activities and internal system activities. This universal monitoring capability enables the system to detect various hacking methods regardless of whether they involve communication changes, making the detection mechanism versatile across different attack vectors.
2Reliability
If traditional communication monitoring is implemented, then system complexity is reduced, but detection reliability is insufficient
Solution Approach 1:
The monitoring system is segmented into distinct components: communication monitoring modules and internal activity monitoring modules. Each module independently monitors specific aspects (network traffic vs. CPU/memory usage), and their results are combined for comprehensive intrusion detection. This segmentation improves reliability without creating a monolithic complex system.
Solution Approach 2:
The system introduces activity value thresholds as intermediary reference points. Instead of directly comparing complex monitoring data, the system compares activity values against pre-established thresholds to determine intrusions. This intermediary approach simplifies the detection logic while maintaining high reliability through objective criterion-based detection.
Data Source
AI summary
A method for detecting an intrusion (i.e. hacking) of an electronic device includes determining an expected activity value associated with one or more software applications executing on a processor, monitoring the one or more software applications executing on the processor to determine a current activity value associated with the one or more software applications, determining whether the current activity value exceeds a threshold associated with the expected activity value, and in response to determining that the current activity value exceeds the threshold, initiating one or more security actions associated with the one or more software applications. A system for detecting an intrusion of an electronic device includes an intrusion detection module configured to perform the steps of the method.