Vehicle Network Intrusion Detection Using Cyclic Message Counters
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Connected vehicles are vulnerable to cyber intrusions through wireless networks, posing a significant threat to automotive cybersecurity, necessitating real-time detection of such intrusions.
Innovation Solution
Implementing a method involving timers and counters to monitor message and signal exchanges within a predetermined time frame, detecting intrusions based on deviations from expected communication patterns, such as exceeding or failing to meet predefined thresholds in message or signal counts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If real-time intrusion detection is implemented in connected vehicles, then security of vehicle electronics is improved, but device complexity increases
Solution Approach 1:
The detection system is divided into multiple independent counter modules (first counter, second counter, third counter, fourth counter) that each monitor specific aspects of communication patterns. This segmentation allows the complex detection task to be distributed across simpler, specialized components, improving security while managing system complexity through modular design
Solution Approach 2:
The system pre-establishes expected communication patterns and thresholds before intrusion detection begins. By having predetermined expectations for message frequencies and communication behaviors, the system can quickly compare actual communications against these pre-set criteria, enabling real-time detection without complex runtime analysis
2Measurement precision
If message monitoring thresholds are set to detect subtle intrusions, then measurement precision is improved, but false intrusion detection increases
Solution Approach 1:
The system uses multiple counters with different threshold criteria rather than a single detection mechanism. By requiring multiple conditions to be met simultaneously (e.g., both first and second counters indicating anomalies, or specific combinations of counter states), the system achieves precise detection while filtering out false positives that would trigger individual counters alone
Solution Approach 2:
The detection system continuously monitors communication patterns and adjusts its assessment based on accumulated counter values and their relationships. The system uses feedback from multiple counter states to refine intrusion determination, comparing actual communication frequencies against expected patterns and using the combined information from all counters to make accurate intrusion decisions
3Reliability
If comprehensive communication monitoring is performed, then intrusion detection capability is improved, but processing time increases
Solution Approach 1:
The system monitors communications in periodic intervals using timers and predefined measurement periods. By dividing continuous monitoring into discrete time windows and evaluating counter values at regular intervals, the system maintains comprehensive detection capability while processing data in manageable batches, reducing overall processing time compared to continuous real-time analysis of every message
Solution Approach 2:
The system pre-defines communication patterns, expected frequencies, and threshold values before monitoring begins. This preliminary setup allows the monitoring process to simply compare actual communications against pre-established criteria rather than performing complex analysis, significantly reducing processing time while maintaining comprehensive detection
Data Source
AI summary
Methods and systems of improving security of a computing system having a network of embedded devices are disclosed. The method includes starting a timer of a predetermined length of time, obtaining an expected number of cyclic messages to be received within the predetermined length of time, incrementing a message counter each time a cyclic message is received within the predetermined length of time, incrementing a set counter in response to an actual number of cyclic messages received by the end of the predetermined length of time exceeding the expected number of cyclic messages to be received by a first threshold value, and detecting an intrusion in the system in response to the set counter exceeding a second threshold value by the end of the predetermined length of time.