In-Vehicle Intrusion Detection System with Rule Engine Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing in-vehicle network security systems face challenges in efficiently detecting and responding to malicious messages while maintaining robustness and reducing system resource utilization.
Innovation Solution
The proposed architecture for an Intrusion Detection System (IDS) includes a message queue module, storage for a rule set, and a rule engine that applies multiple detection techniques (static, misuse, and anomaly detection) to identify security threats, with the ability to bypass subsequent detection techniques once a threat is identified.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multiple detection techniques (static, misuse, anomaly detection) are applied sequentially to all messages, then detection robustness is improved, but system resource utilization increases
Solution Approach 1:
The detection system is segmented into multiple detection techniques (static detection, misuse detection, anomaly detection) that process messages in sequence. Each technique acts as an independent filtering stage, allowing the system to maintain robust multi-technique detection while managing resource usage by processing only necessary messages through each stage.
Solution Approach 2:
The system applies partial action by selectively applying subsequent detection techniques only when needed. Once a message is identified as a security threat by any detection technique, the system stops applying remaining techniques to that message, thereby reducing unnecessary resource consumption while maintaining detection effectiveness.
2Measurement precision
If all detection techniques are applied to every message, then malicious message detection accuracy is improved, but detection time increases
Solution Approach 1:
The system performs preliminary detection using static detection first, which quickly identifies obvious security threats based on predefined rules. This preliminary action filters out many malicious messages before they reach more time-consuming detection techniques, thereby maintaining detection accuracy while reducing overall detection time.
Solution Approach 2:
The system implements skipping by bypassing subsequent detection techniques once a message is identified as a security threat. This allows the system to maintain high detection accuracy by applying multiple techniques when needed, while significantly reducing detection time for messages that are already identified as threats or clearly benign.
3Productivity
If sequential application of multiple detection techniques is implemented, then detection efficiency is improved, but system complexity increases
Solution Approach 1:
The detection system is divided into distinct modular components (message queue module, storage module, rule engine with separate detection techniques). Each module has a specific function and can be independently configured and maintained, which manages system complexity while enabling efficient sequential processing of messages through multiple detection stages.
Data Source
AI summary
A system and a method of providing security to an in-vehicle network are provided. The method efficiently operates multiple detection techniques to maintain robustness against malicious message detection while increasing overall detection efficiency.