On-board Vehicle Network Intrusion Detection via Prohibited Message Sequences

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Current automotive network security systems lack real-time intrusion detection mechanisms, making them vulnerable to attacks despite existing methods being unsuitable for the automotive domain, and untimely detection can lead to dangerous vehicle malfunctions.

Innovation Solution

A method for real-time intrusion detection in on-board vehicle communication networks using a prohibited formal language and automaton data structure that identifies sequences of messages that do not comply with organic specifications, allowing for rapid detection without double monitoring or complex application-level analysis.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If traditional network protocols are used without additional security mechanisms, then the system maintains simplicity and compatibility, but the vehicle becomes vulnerable to intrusions through multiple communication interfaces

Engineering Contradiction:
ImprovesecurityVSAvoidsystem complexity
Core Design Contradiction:
ReliabilityVSDevice complexity

Solution Approach 1:

The patent introduces an intrusion detection system as an intermediary component that monitors communication between external interfaces and the vehicle's internal network. This mediator analyzes message sequences without disrupting normal communication, providing security while maintaining system simplicity through non-intrusive monitoring.

Inventive Principle:
Principle #24Intermediary (Mediator)

Solution Approach 2:

The system performs preliminary analysis of message sequences by maintaining a prohibited formal language database that defines unauthorized communication patterns. By pre-defining these prohibited sequences, the system can detect intrusions before they execute harmful actions, preventing security breaches rather than merely responding to them.

Inventive Principle:
Principle #10Preliminary action

2Measurement precision

If complex intrusion detection methods with double monitoring are implemented, then detection accuracy improves, but real-time performance deteriorates due to processing overhead

Engineering Contradiction:
Improveintrusion detection accuracyVSAvoidreal-time detection speed
Core Design Contradiction:
Measurement precisionVSProductivity

Solution Approach 1:

The intrusion detection system segments the monitoring task by separating the analysis of individual messages from the analysis of message sequences. The system maintains separate data structures for prohibited formal languages and observed message sequences, allowing efficient comparison without requiring simultaneous double monitoring of all communication channels.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The system creates a simplified copy of the communication protocol's formal language rules and stores them in a prohibited formal language database. By working with this copied and structured representation rather than analyzing raw messages directly, the system achieves accurate intrusion detection with reduced computational overhead and improved real-time performance.

Inventive Principle:
Principle #26Copying

3Measurement precision

If a posteriori examination of recorded messages is used, then comprehensive analysis is achieved, but timely response to intrusions is lost

Engineering Contradiction:
Improveintrusion analysis completenessVSAvoidresponse time
Core Design Contradiction:
Measurement precisionVSLoss of time

Solution Approach 1:

The system implements continuous real-time monitoring of message sequences on the vehicle's communication bus. Instead of periodic sampling or post-event analysis, the intrusion detection system continuously compares incoming messages against the prohibited formal language database, ensuring both comprehensive detection and immediate response to intrusions as they occur.

Inventive Principle:
Principle #20Continuity of useful action

Solution Approach 2:

The system provides immediate feedback when a prohibited message sequence is detected by comparing observed sequences against the prohibited formal language in real-time. This feedback mechanism triggers instant alarm signals and can initiate countermeasures without delay, closing the loop between detection and response much faster than a posteriori examination methods.

Inventive Principle:
Principle #23Feedback

4Measurement precision

If application-level analysis is performed to identify intrusion patterns, then detection accuracy improves, but processing complexity and time requirements increase

Engineering Contradiction:
Improveintrusion detection accuracyVSAvoidanalysis complexity
Core Design Contradiction:
Measurement precisionVSDevice complexity

Solution Approach 1:

Instead of analyzing messages at the complex application level to infer intrusion patterns, the system inverts the approach by defining prohibited patterns at the protocol level using formal languages. This inversion allows detection to occur at lower protocol layers where messages have simpler structures, reducing analysis complexity while maintaining detection accuracy through rigorous formal language definitions.

Inventive Principle:
Principle #13The other way round (Inversion)

Data Source

PatentEP3205070B1On-board vehicle network system and method for detecting intrusions on the on-board network
Publication Date: 2021.08.11 RENAULT SA
  • EP3205070B1 patent drawingFigure 1
  • EP3205070B1 patent drawingFigure 2a~2c
  • EP3205070B1 patent drawingFigure 3

AI summary

The invention relates to a method of real-time detection of intrusions in an on-board vehicle communication network, comprising the steps of observing (100) a stream of messages transmitted over the on-board network and detecting intrusions when the observed stream contains a prohibited message. The invention is characterized in that the method comprises at least one step of: - accessing (103, 107), in the memory of at least one on-board computer of the vehicle, at least one data structure encoding prohibited message sequences transmitted over the on-board network, - detecting (104, 108) an intrusion when observation of the stream reveals a prohibited message to be a final message in a prohibited sequence.