Vehicle Network Unauthorized Message Detection via Transmission Interval Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing vehicle-mounted communication systems face challenges in accurately detecting unauthorized messages due to vulnerabilities in protocol, illegal key acquisition, and obsolescence of encryption algorithms, which compromise network security.
Innovation Solution
A detecting device and method that monitor transmission messages in a vehicle-mounted network, acquire the distribution of transmission intervals, and detect unauthorized messages based on these intervals, using a monitoring unit, acquisition unit, and detecting unit to identify anomalies in transmission patterns.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If message authentication codes are used for security, then network security is improved, but detection accuracy of unauthorized messages deteriorates due to protocol vulnerabilities and key acquisition attacks
Solution Approach 1:
The patent introduces a gateway device as an intermediary between the ECU and the external network. The gateway monitors and analyzes communication messages, using statistical methods to detect anomalies without requiring direct access to encryption keys or modification of the existing authentication protocol. This intermediary approach enables detection of unauthorized messages while maintaining the existing security infrastructure.
Solution Approach 2:
The patent replaces traditional cryptographic verification mechanisms with a statistical analysis approach. Instead of relying solely on message authentication codes that are vulnerable to key acquisition and protocol attacks, the system uses transmission interval distribution analysis to detect unauthorized messages. This substitution transforms the detection mechanism from cryptographic verification to statistical pattern recognition.
2Reliability
If encryption algorithms are updated to counter obsolescence, then security is improved, but system complexity increases
Solution Approach 1:
The gateway device performs multiple functions: it relays messages between the ECU and external network, monitors transmission intervals, analyzes statistical distributions, and detects unauthorized messages. By consolidating these diverse functions into a single device, the patent avoids the complexity that would arise from implementing multiple separate security systems or frequently updating encryption algorithms across multiple components.
3Measurement precision
If transmission interval monitoring is implemented, then detection accuracy is improved, but false positives increase due to natural variations in transmission intervals
Solution Approach 1:
The patent performs preliminary statistical analysis by collecting transmission interval data and establishing a normal distribution model before actual detection begins. The gateway pre-calculates the mean and standard deviation of transmission intervals under normal operating conditions. This preliminary action creates a baseline that accounts for natural variations, enabling the system to distinguish between normal fluctuations and genuine anomalies, thereby reducing false positives.
Data Source
AI summary
Provided is a detecting device which detects an unauthorized message in a vehicle-mounted network including a plurality of vehicle-mounted devices and includes a monitoring unit that monitors a transmission message in the vehicle-mounted network, an acquisition unit that acquires a distribution of transmission intervals between the transmission messages, and a detecting unit that detects the unauthorized message on the basis of a monitoring result of the monitoring unit and the distribution acquired by the acquisition unit.