Vehicle Bus Message Interception for Targeted Attack Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current intrusion detection systems in vehicles are inefficient in detecting complex targeted attacks on electronic control units (ECUs) due to their reliance on statistical databases and inability to adapt to the network architecture of vehicles, particularly the broadcast nature of the CAN protocol, which makes it difficult to distinguish between legitimate and malicious messages.
Innovation Solution
A computer-implemented method and system that intercepts messages on a communications bus, determines recipient ECUs, and stores these messages and information in a log to detect attacks based on predefined rules associated with indicators of compromise, allowing for the blocking of malicious messages and preventing potential attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing intrusion detection systems use statistical databases to detect anomalies, then they can identify certain patterns of malicious activity, but they cannot efficiently detect complex targeted attacks and require large statistical databases that increase system complexity
Solution Approach 1:
The system segments the attack detection process into multiple components: message interception at the bus level, logging with recipient ECU identification, rule-based analysis of intercepted messages, and differentiated response actions. This segmentation allows efficient detection of complex targeted attacks without requiring large statistical databases, as each component handles a specific aspect of the detection process independently
Solution Approach 2:
The system performs preliminary actions by pre-defining rules and response actions before attacks occur. Rules are established that specify conditions for detecting various types of attacks (single ECU, multiple ECUs, specific message patterns), and corresponding response actions are pre-configured. This preliminary setup enables rapid detection and response to complex targeted attacks without requiring real-time statistical analysis
2Measurement precision
If the system intercepts and logs all messages on the communications bus to detect attacks, then attack detection accuracy improves, but the loss of time for processing and analyzing messages increases
Solution Approach 1:
The system performs preliminary action by pre-defining rules that specify detection conditions and corresponding response actions before attacks occur. Rules are established that cover various attack scenarios (single ECU attacks, multiple ECU attacks, specific message patterns), enabling rapid rule-based analysis of intercepted messages without requiring time-consuming statistical database queries or complex real-time analysis
Solution Approach 2:
The system introduces an intermediary logging component that captures and stores intercepted messages with recipient ECU identification. This log serves as a buffer between message interception and attack detection analysis, allowing the system to process messages at a controlled pace while maintaining complete records for accurate attack detection. The log enables retrospective analysis without blocking real-time message flow
3Reliability
If the system blocks malicious messages immediately upon detection, then security effectiveness improves, but the ability to collect evidence for investigation is reduced
Solution Approach 1:
The system performs preliminary action by continuously logging all intercepted messages and recipient ECU information before any blocking actions occur. This ensures that complete evidence is preserved in the log for subsequent investigation, while still enabling immediate blocking of detected attacks through pre-configured response actions. The log maintains a historical record of all messages, including those that were blocked
Solution Approach 2:
The logging system serves as an intermediary between message interception and blocking actions. It captures and preserves complete message data and recipient information before any security responses are executed. This intermediary log ensures that evidence is maintained for investigation purposes while still allowing the system to block malicious messages effectively when attacks are detected
Data Source
Figure 1A
Figure 1B
Figure 2A
AI summary
Disclosed are systems and methods for detecting and blocking attacks on electronics systems of a means of transportation. A protection module intercepts messages being transmitted on the buses of the means of transportation and saves the intercepted messages, and also for each intercepted message at least one ECU of the means of transportation which is the recipient of that message. The protection module detects computer attacks on the electronics systems by applying one or more rules, which can be received from a security server, to the saved data in the log. The rules may depend on one or more indicators of compromise that include malicious messages used in a computer attack and information on at least one ECU that is a recipient of the malicious messages. The described system further blocks the computer attacks by blocking, modifying, or changing communications within the communications bus of the vehicle.