In-Vehicle Network Anomaly Detection Using ECU Attributes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing anomaly detection methods for in-vehicle networks struggle to maintain accuracy in detecting unauthorized communication due to dynamic changes in network communication tendencies caused by updates and ECU changes, leading to potential safety risks.
Innovation Solution
Anomaly detection devices and methods that utilize ECU attribute storage to classify communication based on the functions and types of information handled by electronic control units, enabling detection of anomalous communication by analyzing message source and destination attributes, and updating these attributes based on communication logs and network changes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If detection rules are updated frequently to adapt to dynamic communication changes, then detection accuracy is improved, but system complexity and maintenance burden increase
Solution Approach 1:
The system dynamically adapts detection rules based on learned communication patterns rather than using static, pre-defined rules. The anomaly detection ECU continuously updates its understanding of normal communication behavior, allowing the detection mechanism to evolve with the system while maintaining manageable complexity through automated learning processes
Solution Approach 2:
The anomaly detection system performs self-learning by automatically analyzing communication logs and updating its detection criteria without requiring manual intervention. This self-service capability allows the system to adapt to changes in communication patterns while reducing the maintenance burden on operators
2Ease of manufacture
If traditional IP address-based detection rules are used, then implementation is simple, but detection accuracy deteriorates due to dynamic communication patterns
Solution Approach 1:
The system transitions from using static IP address parameters to dynamic parameters based on ECU attributes and learned communication patterns. By changing the detection parameters from fixed network addresses to flexible attribute-based criteria, the system maintains ease of implementation while significantly improving detection accuracy in dynamic environments
3Measurement precision
If ECU attributes are used for anomaly detection, then detection accuracy is improved, but information processing requirements increase
Solution Approach 1:
ECU attributes are pre-established and stored before anomaly detection is performed. This preliminary preparation allows the detection process to efficiently compare communication patterns against known attributes without requiring intensive real-time processing, thereby reducing energy consumption during actual anomaly detection operations
Data Source
AI summary
An anomaly detection device detects an anomaly in an in-vehicle network system including two or more electronic control units and one or more networks and includes: ECU attribute storage in which attributes of the two or more electronic control units each of which has been set for a corresponding one of the two or more electronic control units are stored; a communicator that transmits and receives a message on the one or more networks; and an anomaly detector that detects anomalous communication by using an attribute of a message source electronic control unit or an attribute of a message destination electronic control unit among the attributes stored in the ECU attribute storage. The attribute stored in the ECU attribute storage indicates the function of the electronic control unit including the attribute or the type of information that is handled by the electronic control unit including the attribute.