Vehicle Bus Message Interception for Targeted Attack Detection

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Current intrusion detection systems in vehicles are inefficient in detecting complex targeted attacks on electronic control units (ECUs) due to their reliance on statistical databases and inability to adapt to the network architecture of vehicles, particularly the broadcast nature of the CAN protocol, which makes it difficult to distinguish between legitimate and malicious messages.

Innovation Solution

A computer-implemented method and system that intercepts messages on a communications bus, determines recipient ECUs, and stores these messages and information in a log to detect attacks based on predefined rules associated with indicators of compromise, allowing for the blocking of malicious messages and preventing potential attacks.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If existing intrusion detection systems use statistical databases to detect anomalies, then they can identify certain patterns of malicious activity, but they cannot efficiently detect complex targeted attacks and require large statistical databases that increase system complexity

Engineering Contradiction:
Improveattack detection capabilityVSAvoidsystem complexity
Core Design Contradiction:
ReliabilityVSDevice complexity

Solution Approach 1:

The system segments the attack detection process into multiple components: message interception at the bus level, logging with recipient ECU identification, rule-based analysis of intercepted messages, and differentiated response actions. This segmentation allows efficient detection of complex targeted attacks without requiring large statistical databases, as each component handles a specific aspect of the detection process independently

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The system performs preliminary actions by pre-defining rules and response actions before attacks occur. Rules are established that specify conditions for detecting various types of attacks (single ECU, multiple ECUs, specific message patterns), and corresponding response actions are pre-configured. This preliminary setup enables rapid detection and response to complex targeted attacks without requiring real-time statistical analysis

Inventive Principle:
Principle #10Preliminary action

2Measurement precision

If the system intercepts and logs all messages on the communications bus to detect attacks, then attack detection accuracy improves, but the loss of time for processing and analyzing messages increases

Engineering Contradiction:
Improveattack detection accuracyVSAvoidmessage processing time
Core Design Contradiction:
Measurement precisionVSLoss of time

Solution Approach 1:

The system performs preliminary action by pre-defining rules that specify detection conditions and corresponding response actions before attacks occur. Rules are established that cover various attack scenarios (single ECU attacks, multiple ECU attacks, specific message patterns), enabling rapid rule-based analysis of intercepted messages without requiring time-consuming statistical database queries or complex real-time analysis

Inventive Principle:
Principle #10Preliminary action

Solution Approach 2:

The system introduces an intermediary logging component that captures and stores intercepted messages with recipient ECU identification. This log serves as a buffer between message interception and attack detection analysis, allowing the system to process messages at a controlled pace while maintaining complete records for accurate attack detection. The log enables retrospective analysis without blocking real-time message flow

Inventive Principle:
Principle #24Intermediary (Mediator)

3Reliability

If the system blocks malicious messages immediately upon detection, then security effectiveness improves, but the ability to collect evidence for investigation is reduced

Engineering Contradiction:
Improvesecurity effectivenessVSAvoidevidence preservation
Core Design Contradiction:
ReliabilityVSLoss of information

Solution Approach 1:

The system performs preliminary action by continuously logging all intercepted messages and recipient ECU information before any blocking actions occur. This ensures that complete evidence is preserved in the log for subsequent investigation, while still enabling immediate blocking of detected attacks through pre-configured response actions. The log maintains a historical record of all messages, including those that were blocked

Inventive Principle:
Principle #10Preliminary action

Solution Approach 2:

The logging system serves as an intermediary between message interception and blocking actions. It captures and preserves complete message data and recipient information before any security responses are executed. This intermediary log ensures that evidence is maintained for investigation purposes while still allowing the system to block malicious messages effectively when attacks are detected

Inventive Principle:
Principle #24Intermediary (Mediator)

Data Source

PatentEP3547192B1System and method of blocking a computer attack on a means of transportation
Publication Date: 2022.10.26 AO KASPERSKY LAB
  • EP3547192B1 patent drawingFigure 1A
  • EP3547192B1 patent drawingFigure 1B
  • EP3547192B1 patent drawingFigure 2A

AI summary

Disclosed are systems and methods for detecting and blocking attacks on electronics systems of a means of transportation. A protection module intercepts messages being transmitted on the buses of the means of transportation and saves the intercepted messages, and also for each intercepted message at least one ECU of the means of transportation which is the recipient of that message. The protection module detects computer attacks on the electronics systems by applying one or more rules, which can be received from a security server, to the saved data in the log. The rules may depend on one or more indicators of compromise that include malicious messages used in a computer attack and information on at least one ECU that is a recipient of the malicious messages. The described system further blocks the computer attacks by blocking, modifying, or changing communications within the communications bus of the vehicle.