Sparse Low-Rank Transfer Entropy for CAN Bus Anomaly Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing anomaly detection systems for CAN bus data are inadequate in detecting subtle changes and various types of attacks, such as spoofing or altering messages, which can pose serious safety risks in vehicles.
Innovation Solution
A system using sparse and low-rank decomposition of transfer entropy matrices to analyze CAN bus message timing, identifying normal and abnormal patterns by decomposing temporal dependency matrices into component matrices and comparing them with new network traffic to detect anomalies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If frequency-based anomaly detection method is used to compare current and historical packet timing, then inserted packets can be detected, but it fails to detect subtle changes in non-periodic packets and other attack types such as changing packet order
Solution Approach 1:
The patent changes the detection parameter from simple inter-packet timing statistics to transfer entropy, which measures the conditional probability of packet sequences. This parameter transformation enables detection of subtle changes in packet timing patterns and sequence relationships, addressing the limitation of frequency-based methods that only work for periodic packets.
Solution Approach 2:
The patent introduces transfer entropy as an intermediary metric that captures the temporal dependencies and sequential relationships between CAN bus packets. This intermediary measure allows the system to detect various attack types including packet insertion, deletion, reordering, and subtle timing modifications by analyzing the informational relationships between consecutive packets.
2Device complexity
If Hamming distance of data packets is used as a measure of normality, then simple packet comparison is possible, but it is unreliable for detecting anomalies
Solution Approach 1:
The patent replaces the Hamming distance metric with transfer entropy, transforming the measurement from a simple bitwise difference to a probabilistic measure of temporal dependency. This parameter change significantly improves measurement precision for anomaly detection while maintaining computational feasibility through efficient estimation methods.
3Reliability
If inter-packet timing statistic is used with one-class support vector machine, then inserted packets can be detected with good reliability, but it cannot detect subtle changes in non-periodic packets
Solution Approach 1:
The patent makes the detection method universal by using transfer entropy, which can handle both periodic and non-periodic packet patterns. The transfer entropy framework naturally adapts to different packet timing characteristics without requiring separate detection mechanisms, providing both insertion detection and subtle change detection in a unified approach.
Data Source
Figure 1
Figure 2
Figure 3A
AI summary
Described is a system for detecting cyber intrusions based on analysis of network traffic. During operation, the system performs a statistical analysis of message tuning on network traffic to produce a temporal dependency matrix representative of temporal dependency between different message types in the network traffic. The sets of temporal dependency matrices are decomposed into component matrices, where at least one component matrix represents typical properties of these matrices and at least one other component matrix represents atypical properties of the matrices. A new temporal dependency matrix is generated based on new network traffic. Finally, anomalous behavior is detected in the new network traffic by comparing component matrices of the new temporal dependency matrix, with component matrices of the temporal dependency matrices tinder normal operating conditions.