Vehicle Control Monitoring for Real-Time Cyberattack Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing vehicle control systems fail to immediately detect abnormalities during unknown cyberattacks, as they rely on post-process judgment and do not effectively monitor execution orders and output values in real-time, allowing potential malicious changes to go undetected until the process is complete.
Innovation Solution
A control system that includes a control unit, a calculation unit, a storage unit for normal-case information, an acquisition unit for execution-case information, a comparison unit, and a judgment unit to continuously compare execution orders and output values of the calculation process steps, enabling immediate abnormality detection and switching to a standby control process if anomalies are found.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If memory check is constantly performed during traveling to detect unknown cyberattacks, then security reliability is improved, but processing load increases
Solution Approach 1:
The system performs preliminary actions by storing execution order information and output value information before the calculation process begins. During execution, it only needs to compare current values against the pre-stored information, enabling rapid anomaly detection without heavy processing load. This resolves the contradiction by preparing detection data in advance rather than performing complex analysis in real-time.
Solution Approach 2:
The detection mechanism is segmented into distinct functional units: storing execution order information, storing output value information, comparing execution orders, and comparing output values. This segmentation allows the system to perform lightweight, modular operations during calculation processes rather than executing heavy comprehensive memory checks, thereby maintaining low processing load while ensuring security reliability.
2Device complexity
If abnormality detection judgment is performed after processes are completed to reduce processing load, then processing load is reduced, but detection timing is delayed
Solution Approach 1:
The system maintains continuous useful action by performing comparison operations during each calculation process step rather than waiting for completion. The execution order comparison unit and output value comparison unit continuously monitor the calculation process, enabling immediate anomaly detection. This continuous monitoring approach eliminates detection delays while keeping processing load low through efficient comparison operations.
Solution Approach 2:
By pre-storing the correct execution order and output values before calculation begins, the system enables immediate comparison during each calculation step. This preliminary preparation allows the system to detect anomalies as they occur during the calculation process rather than waiting for completion, thus achieving both low processing load and immediate detection timing.
3Reliability
If message authentication or digital signature is used to protect against known attacks, then security protection is improved, but unknown cyberattacks cannot be detected
Solution Approach 1:
The system creates copies of the expected execution flow by storing execution order information and output value information as reference data. During calculation processes, it compares actual execution against these copied reference patterns. This copying mechanism enables detection of any deviations from normal behavior, including unknown cyberattacks, without relying on pre-defined authentication protocols. The comparison-based approach provides both security protection and broad detection capability.
Data Source
AI summary
In a control process of a control device of a vehicle, normal-case information and execution-case information are compared, and if at least either compared execution orders of a calculation process or compared output values in steps of the calculation process are different from each other, it is judged that abnormality has occurred, thus providing a control system that enables normal traveling by detecting abnormality in the vehicle even if an unknown cyberattack is performed during traveling.