In-Vehicle Anomaly Detection via Switch Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing in-vehicle network systems lack effective anomaly detection, particularly for Ethernet frames, due to limited resources in Ethernet switches, which hinders early detection of unauthorized vehicle control and reduces the accuracy and efficiency of anomaly detection processes.
Innovation Solution
An anomaly detection device that distributes the anomaly detection process across multiple Ethernet switches, using hardware for initial frame inspection and software for deeper analysis, allowing flexible rule definition and reducing processing load by transferring frames to other devices for further analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If anomaly detection is performed on all frames in the in-vehicle network, then detection accuracy is improved, but processing load and system complexity increase significantly
Solution Approach 1:
The anomaly detection system is segmented into multiple Ethernet switches, where each switch performs detection on a subset of frames. The detection process is divided between hardware-based initial inspection and software-based deeper analysis, distributing the overall detection task across multiple devices to reduce individual device complexity while maintaining comprehensive detection accuracy.
Solution Approach 2:
The system performs partial anomaly detection by initially inspecting only critical frame attributes using hardware resources, then selectively applying more resource-intensive software-based analysis only to frames that require deeper inspection. This partial action approach maintains detection accuracy for critical anomalies while reducing overall processing load and system complexity.
2Measurement precision
If deeper software-based analysis is performed on frames, then anomaly detection accuracy is improved, but processing time and resource consumption increase
Solution Approach 1:
The system performs preliminary hardware-based inspection of frame attributes before applying software-based analysis. This preliminary action identifies frames that require deeper inspection, allowing the system to skip software analysis for normal frames and apply it only when necessary, thereby reducing average processing time while maintaining detection accuracy for anomalous frames.
Solution Approach 2:
Software-based deeper analysis is applied selectively only to frames that pass through the hardware inspection stage or are identified as suspicious, rather than performing full software analysis on all frames. This partial application of resource-intensive analysis reduces overall processing time while maintaining high detection accuracy for anomalous frames.
3Speed
If hardware resources are used for frame inspection, then processing speed is improved, but detection capability is limited compared to software-based analysis
Solution Approach 1:
The system merges hardware-based initial inspection with software-based deeper analysis into a unified anomaly detection process. Hardware resources provide high-speed filtering and initial detection, while software resources provide comprehensive analysis and flexible rule evaluation. This combination achieves both high processing speed for normal frames and versatile detection capability for anomalous frames.
Solution Approach 2:
The system adds a software-based analysis dimension to the hardware inspection process. While hardware operates in the speed dimension, software provides an additional dimension of detection capability and flexibility. This multi-dimensional approach allows the system to maintain high speed through hardware while achieving comprehensive detection through software when needed.
Data Source
AI summary
An anomaly detection device for detecting anomaly in frames flowing through an in-vehicle network system includes: an obtainer that obtains one or more frames; a first holder holding a first rule defining a rule indicating that when a frame satisfies a first condition based on a source or a destination, the frame is to be transferred; a first frame controller that transfers the one or more frames in accordance with the first rule; a second holder holding a second rule defining a rule indicating that a frame satisfying a second condition is to be determined as being anomalous; and a second frame controller that performs, in accordance with the second rule, an anomaly detection process on each of the one or more frames transferred by the first frame controller. When an anomalous frame is detected, the second frame controller provides or stores a detection result.