Vehicle Log Anomaly Scoring for Reverse Engineering Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing in-vehicle network security methods, such as those described in Non Patent Literature 1 and Patent Literature 1, are inadequate in preventing unauthorized control and do not effectively prevent attacks, particularly due to encryption overhead and key management issues, and lack comprehensive measures against anomalous communication.
Innovation Solution
An anomalous vehicle detection server that monitors vehicle logs to detect suspicious behaviors indicative of reverse engineering, calculates an anomaly score, and takes countermeasures based on the score to enhance security, including shutting down network interfaces, limiting access, and alerting drivers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encrypted communication is used to prevent unauthorized control, then security is improved, but communication overhead increases and key management becomes complex
Solution Approach 1:
The patent introduces an in-vehicle network monitoring device as an intermediary that acts as a trusted third party. This device monitors communication frames in real-time and determines authenticity without requiring end ECUs to perform complex encryption/decryption operations. The monitoring device holds the secret key and performs authentication centrally, thereby reducing key management complexity at individual ECUs while maintaining security through continuous monitoring and frame authentication.
2Reliability
If encrypted communication is implemented, then unauthorized control is prevented, but communication efficiency decreases due to processing overhead
Solution Approach 1:
The patent implements preliminary action by pre-establishing secret keys between the monitoring device and ECUs before actual communication occurs. The monitoring device continuously monitors and authenticates frames in real-time, performing security checks in advance rather than requiring full encryption/decryption processing for every frame. This approach maintains security while reducing the computational overhead during actual communication operations.
3Reliability
If comprehensive anomaly detection is implemented, then attack prevention is improved, but system complexity increases
Solution Approach 1:
The monitoring device serves as a centralized intermediary that handles all complex anomaly detection and authentication operations. Instead of distributing complex detection algorithms across multiple ECUs, the patent concentrates the intelligence in the monitoring device, which analyzes communication patterns, detects anomalies, and determines frame authenticity. This centralized approach improves attack prevention capability while managing system complexity through a dedicated security component.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
An anomalous vehicle detection server (10) includes an anomaly score calculator (106) that detects a suspicious behavior different from a predetermined driving behavior based on pieces of vehicle information that are received from a plurality of vehicles, respectively, and are each based on a vehicle log including the content of an event that has occurred in a vehicle system (20) provided in the vehicle, and acquires an anomaly score of each of the plurality of vehicles that indicates a likelihood that reverse engineering is performed on the vehicle; and an anomalous vehicle determiner (108) that determines whether one vehicle of the plurality of vehicles is an anomalous vehicle based on the anomaly score of the one vehicle and a statistical value of the anomaly scores of two or more vehicles of the plurality of vehicles.