Vehicle Application Anomaly Detection Using Mobility State Data
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing anomaly detection devices for vehicles, such as those described in PTL1, are insufficient in addressing security threats from malicious third parties who can attach vehicles by transmitting authorized CAN messages to the Electronic Control Unit, as they do not consider such attacks and lack adequate security measures.
Innovation Solution
An information processing device connected to a mobility network that includes a storage for determination criterion information and a detector to obtain behavior and state information, using models like rule-based or machine learning to identify anomalies in application behavior, enhancing security by defining normal and anomalous behaviors and states to detect malicious activities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If anomaly detection is performed using traditional methods (monitoring file accesses with LSM), then basic security monitoring is achieved, but detection precision against sophisticated attacks (such as authorized CAN message transmissions) is insufficient
Solution Approach 1:
The detection system is segmented into multiple independent components: behavior information acquisition unit, state information acquisition unit, determination criterion storage, and anomaly detection unit. Each component handles a specific aspect of detection, allowing the system to achieve high detection precision through specialized processing while maintaining manageable complexity through modular architecture.
Solution Approach 2:
The system transitions from traditional single-dimension file access monitoring to multi-dimensional analysis by simultaneously acquiring behavior information (application operations) and state information (vehicle system states). This dimensional expansion enables detection of sophisticated attacks that traditional methods miss, achieving higher precision without proportionally increasing complexity.
2Reliability
If comprehensive behavior and state information monitoring is implemented to detect sophisticated attacks, then detection precision improves, but system complexity and resource consumption increase
Solution Approach 1:
Determination criterion information is pre-stored in the system, containing predefined rules and thresholds for normal behavior patterns. This preliminary preparation allows the anomaly detection unit to quickly compare real-time behavior and state information against established criteria, achieving high reliability without requiring complex real-time analysis algorithms that would increase system complexity.
Solution Approach 2:
The system introduces determination criterion information as an intermediary layer between raw behavior/state data and anomaly detection results. This intermediary contains pre-processed knowledge about normal system behavior, enabling the detector to reliably identify anomalies through simple comparison operations rather than complex analytical processing.
3Adaptability or versatility
If traditional anomaly detection methods are used, then system simplicity is maintained, but the system cannot detect sophisticated attacks involving authorized CAN messages
Solution Approach 1:
The anomaly detection unit is designed with universal functionality to detect multiple types of attacks through a unified framework. By monitoring both behavior information (application-level operations) and state information (vehicle system states) simultaneously and comparing them against determination criterion information, the system can detect various sophisticated attacks including authorized CAN message transmissions, without requiring separate specialized detection mechanisms for each attack type.
Data Source
AI summary
An information processing device includes: a storage that stores determination criterion information indicating a determination criterion for determining whether or not a behavior of an application operating on a device provided to a vehicle is normal; and a detector that obtains behavior information indicating the behavior of the application, and detects an anomaly in the behavior of the application, based on (i) state information that indicates a state of the mobility and is obtained via the mobility network and (ii) the behavior information obtained and the determination criterion information stored in the storage.