Vehicle Communication Attack Detection via Partial Sequence Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing attack communication detection techniques fail to differentiate between normal events and attacks targeting periodic and event-related IDs in vehicle communication networks, as they cannot accurately assess communication intervals or payload order relations.
Innovation Solution
A detection device and method that extracts and analyzes communication data with predetermined conditions to create partial sequences based on communication intervals and payload order relations, allowing for the detection of attack communications by comparing these sequences against known patterns.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If communication interval-based detection is used, then periodic attacks can be detected, but event-related attacks cannot be differentiated from normal events
Solution Approach 1:
The detection method is segmented into multiple independent detection modules: communication interval detection for periodic IDs and payload order relation detection for event-related IDs. Each module handles specific attack patterns independently, allowing the system to adapt to different attack types without false positives from normal events.
Solution Approach 2:
The detection system dynamically adapts its approach based on the ID type being monitored. For periodic IDs, it uses communication interval analysis; for event-related IDs, it uses payload order relation analysis. This dynamic adaptation allows accurate detection across diverse attack scenarios while maintaining versatility.
2Measurement precision
If payload order relation detection is used, then event-related attacks can be detected, but attacks disguised as normal events cannot be identified
Solution Approach 1:
A learning model serves as an intermediary that learns normal payload order relations from historical data. This learned model acts as a reference to compare against actual communication sequences, enabling detection of attacks disguised as normal events while maintaining low false positive rates by relying on empirically learned patterns rather than rigid rules.
Solution Approach 2:
The system performs preliminary learning of normal communication patterns before actual attack detection. By pre-learning the expected payload order relations from normal operation data, the system establishes a baseline that enables accurate identification of deviations caused by attacks while minimizing false alarms from legitimate variations.
3Productivity
If detection rules are simplified, then detection speed increases, but detection accuracy decreases
Solution Approach 1:
The detection process is segmented into parallel independent checks: communication interval verification and payload order relation verification. Each segment uses simple, fast comparison operations rather than complex analysis, maintaining high detection speed while achieving accurate attack identification through the combination of multiple simple checks.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A detection device includes: an object data extraction unit that extracts, from one or more pieces of communication data which are transmitted from one or more electronic control units, at least part of a payload contained in communication data that satisfies a predetermined condition, information by which the communication interval between the communication data can be calculated, and a serial number of the communication data as object data; a partial sequence creation unit that creates, using the extracted object data, a partial sequence containing information corresponding to at least part of a payload and information indicating a communication interval from two or more pieces of object data with the same serial number; and a detection unit that detects, using the created partial sequence, predetermined communication data based on the order relation between at least part of a payload and the corresponding part of another payload and a communication interval. The predetermined condition is a condition for extracting only communication data which is transmitted periodically and also in conjunction with a predetermined event.