On-board Vehicle Network Intrusion Detection via Prohibited Message Sequences
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current automotive network security systems lack real-time intrusion detection mechanisms, making them vulnerable to attacks despite existing methods being unsuitable for the automotive domain, and untimely detection can lead to dangerous vehicle malfunctions.
Innovation Solution
A method for real-time intrusion detection in on-board vehicle communication networks using a prohibited formal language and automaton data structure that identifies sequences of messages that do not comply with organic specifications, allowing for rapid detection without double monitoring or complex application-level analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional network protocols are used without additional security mechanisms, then the system maintains simplicity and compatibility, but the vehicle becomes vulnerable to intrusions through multiple communication interfaces
Solution Approach 1:
The patent introduces an intrusion detection system as an intermediary component that monitors communication between external interfaces and the vehicle's internal network. This mediator analyzes message sequences without disrupting normal communication, providing security while maintaining system simplicity through non-intrusive monitoring.
Solution Approach 2:
The system performs preliminary analysis of message sequences by maintaining a prohibited formal language database that defines unauthorized communication patterns. By pre-defining these prohibited sequences, the system can detect intrusions before they execute harmful actions, preventing security breaches rather than merely responding to them.
2Measurement precision
If complex intrusion detection methods with double monitoring are implemented, then detection accuracy improves, but real-time performance deteriorates due to processing overhead
Solution Approach 1:
The intrusion detection system segments the monitoring task by separating the analysis of individual messages from the analysis of message sequences. The system maintains separate data structures for prohibited formal languages and observed message sequences, allowing efficient comparison without requiring simultaneous double monitoring of all communication channels.
Solution Approach 2:
The system creates a simplified copy of the communication protocol's formal language rules and stores them in a prohibited formal language database. By working with this copied and structured representation rather than analyzing raw messages directly, the system achieves accurate intrusion detection with reduced computational overhead and improved real-time performance.
3Measurement precision
If a posteriori examination of recorded messages is used, then comprehensive analysis is achieved, but timely response to intrusions is lost
Solution Approach 1:
The system implements continuous real-time monitoring of message sequences on the vehicle's communication bus. Instead of periodic sampling or post-event analysis, the intrusion detection system continuously compares incoming messages against the prohibited formal language database, ensuring both comprehensive detection and immediate response to intrusions as they occur.
Solution Approach 2:
The system provides immediate feedback when a prohibited message sequence is detected by comparing observed sequences against the prohibited formal language in real-time. This feedback mechanism triggers instant alarm signals and can initiate countermeasures without delay, closing the loop between detection and response much faster than a posteriori examination methods.
4Measurement precision
If application-level analysis is performed to identify intrusion patterns, then detection accuracy improves, but processing complexity and time requirements increase
Solution Approach 1:
Instead of analyzing messages at the complex application level to infer intrusion patterns, the system inverts the approach by defining prohibited patterns at the protocol level using formal languages. This inversion allows detection to occur at lower protocol layers where messages have simpler structures, reducing analysis complexity while maintaining detection accuracy through rigorous formal language definitions.
Data Source
Figure 1
Figure 2a~2c
Figure 3
AI summary
The invention relates to a method of real-time detection of intrusions in an on-board vehicle communication network, comprising the steps of observing (100) a stream of messages transmitted over the on-board network and detecting intrusions when the observed stream contains a prohibited message. The invention is characterized in that the method comprises at least one step of: - accessing (103, 107), in the memory of at least one on-board computer of the vehicle, at least one data structure encoding prohibited message sequences transmitted over the on-board network, - detecting (104, 108) an intrusion when observation of the stream reveals a prohibited message to be a final message in a prohibited sequence.