In-Vehicle Service Traffic Filtering Using Dynamic Signatures
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Contemporary vehicles are vulnerable to denial-of-service (DoS) and distributed denial-of-service (DDOS) attacks, which compromise the safety and functionality of advanced systems like LiDAR, OBD, cameras, and cloud-based applications by flooding them with excessive traffic, rendering them unavailable.
Innovation Solution
Implementing a system that uses dynamically changing traffic flow signatures and packet filtering rules to distinguish between legitimate and malicious traffic, prioritizing Quality of Service (QoS) for valid sessions, and dropping suspicious ones, thereby mitigating the impact of DoS and DDOS attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the system processes all incoming sessions equally without prioritization, then network bandwidth and CPU resources are consumed by all traffic including malicious traffic, but legitimate critical services may be overwhelmed during DoS/DDOS attacks
Solution Approach 1:
The system dynamically adjusts QoS priorities of sessions based on real-time flow signature matching. When a session's flow signature matches the expected runtime flow signature, its QoS priority is promoted to ensure critical services receive adequate resources during attacks. This dynamic adjustment allows the system to adapt to changing traffic conditions and maintain service reliability without requiring complex manual configuration
Solution Approach 2:
The system segments incoming sessions into different priority groups based on flow signature matching results. Authenticated sessions with matching signatures are placed in high-priority queues, while sessions with non-matching or suspicious signatures are placed in low-priority queues or dropped. This segmentation allows differential resource allocation, ensuring critical legitimate traffic receives sufficient bandwidth and CPU resources even under attack conditions
2Adaptability or versatility
If the system uses static signature-based filtering, then implementation is simpler, but it cannot adapt to changing attack patterns and may block legitimate traffic or miss evolved malicious traffic
Solution Approach 1:
The system performs preliminary actions by collecting flow signatures from authenticated sessions before attacks occur, and generates expected runtime flow signatures in advance. These pre-generated signatures are stored and ready for immediate comparison when traffic arrives, enabling rapid adaptation to known attack patterns without requiring complex real-time analysis during the attack itself
Solution Approach 2:
The system continuously monitors actual traffic flow signatures and compares them against expected runtime flow signatures. When mismatches are detected, the system can update and regenerate expected signatures based on observed legitimate traffic patterns. This feedback loop enables the system to adapt to evolving attack patterns and maintain accurate filtering criteria without manual intervention
3Speed
If the system promotes QoS priority for sessions with matching flow signatures, then legitimate traffic is prioritized during attacks, but determining accurate flow signatures requires extensive collection and analysis of traffic data
Solution Approach 1:
The system collects flow signatures from authenticated sessions and generates expected runtime flow signatures in advance, before the actual traffic filtering needs to occur. This preliminary signature generation phase allows the system to have ready-made comparison criteria when attacks start, eliminating the need for time-consuming real-time signature analysis during critical moments and enabling immediate QoS prioritization decisions
Data Source
AI summary
Systems and methods include receiving sessions associated with a communication between a client and an in-vehicle application service, assigning received sessions with a quality of service (QoS) processing priority, collecting a flow signature of the sessions, generating an expected runtime flow signature based on the collected flow signature, comparing the flow signature of sessions with the expected runtime flow signature based on a time at which each of the sessions were received, promoting a QoS processing priority of a group of the sessions, and dropping sessions based on a QoS processing priority.