Apparatus and method for detecting in-vehicle network attack

• US 9,231,967 B2
• Filed: 06/17/2013
• Issued: 01/05/2016
• Est. Priority Date: 12/12/2012
• Status: Active Grant

• Current Assignee: Industry-Academic Cooperation Foundation, Chosun University (Chosun University), Hyundai Motor Company (Hyundai Motor Group), Seoul National University R&DB Foundation (Seoul National University)
• Original Assignee: Hyundai Motor Company (Hyundai Motor Group), Industry-Academic Cooperation Foundation Yonsei University, Seoul National University R&DB Foundation (Seoul National University)
• Inventors: Lee, Chung Hi, Lee, Byoung Wook, Bae, Hyun Cheol, No, Jong Seon, Ahn, Hyun Soo, Kim, Ji Youp, Woo, Jun Young, Cho, Chang Min, Kim, Young Sik, Moon, Young Sik
• Primary Examiner(s): Zecher, Dede
• Assistant Examiner(s): LAKHIA, VIRAL S
• Application Number:
  US13/919,940
• Publication Number:
  US 20140165191A1
• Time in Patent Office: 932 Days
• Field of Search: 726 22- 23, 713163-165, 370/395.32
• US Class Current: 1/1
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks

Abstract

An apparatus for detecting an in-vehicle network attack, is configured to cumulatively count packets for each device that has a respective ID and is connected to an in-vehicle network bus. The apparatus is configured to cumulate a check value every time the packets are cumulatively counted to calculate a cumulated value, and determine that an attack is conducted when an average cumulated value obtained by dividing the cumulated value by a cumulative counted value does not exceed a first threshold value.

Claims

1. An apparatus for detecting an in-vehicle network attack under an in-vehicle network environment in which devices having defined priorities for packet transmission are connected to an in-vehicle network bus, the apparatus comprising:

a packet collector configured to collect packets transferred via the in-vehicle network bus;

a packet counter configured to cumulatively count the number of packets collected by the packet collector;

a check value calculator configured to calculate a check value based on a generation time difference of packets having an identical ID;

a cumulated value calculator configured to calculate a cumulated value by summing the check value calculated by the check value calculator and a check value just previously calculated;

an average cumulated value calculator configured to calculate an average cumulated value by dividing the cumulated value calculated by the cumulated value calculator by a value cumulatively counted by the packet counter; and

an attack determinator configured to determine whether an attack occurs based on the average cumulated value calculated by the average cumulated value calculator,

wherein the check value calculator is configured to generate the check value based on a difference between a current time t_c and a t_ID at which a packet having the identical ID is just previously generated.

2. The apparatus according to claim 1, wherein the attack determinator is configured to determine that the attack occurs when the average cumulated value does not exceed a threshold value.

3. The apparatus according to claim 1, wherein the packet counter is configured to classify the packets collected by the packet collector into each ID and then cumulatively count the number of packets for each ID.

4. The apparatus according to claim 1, wherein the packet counter is configured to classify the packets collected by the packet collector into each ID and then cumulatively count the packets of the IDs having a predetermined priority for each ID.

5. The apparatus according to claim 1, wherein the check value calculator is configured to calculate a check value S using the following [Equation A]:

S=log₂(t_c−

t_ID). 

 

[Equation A]

6. A method for detecting an in-vehicle network attack under an in-vehicle network environment in which devices having defined priorities for packet transmission are connected to an in-vehicle network bus, the method comprising:

collecting, by a packet collector, packets transferred via the in-vehicle network bus;

cumulatively counting, by a packet counter, the number of collected packets;

calculating, by a check value calculator, a check value based on a generation time difference of packets having an identical ID;

calculating, by a cumulated value calculator, a cumulated value by summing the calculated check value and a check value just previously calculated;

calculating, by an average cumulated value calculator, an average cumulated value by dividing the calculated cumulated value by a cumulatively counted value; and

determining, by an attack determinator, whether an attack occurs, based on the calculated average cumulated value,

wherein in the calculating of the check value, the check value is generated based on a difference between a current time t_c and a t_ID at which a packet having the identical ID is just previously generated.

7. The method according to claim 6, wherein in the determining of whether the attack occurs, it is determined that the attack occurs, when the average cumulated value does not exceed a threshold value.

8. The method according to claim 6, wherein in the counting of the packets, the packets collected by the packet collector are classified into each ID and then the number of packets is cumulatively counted for each ID.

9. The method according to claim 6, wherein in the counting of the packets, the packets collected by the packet collector are classified into each ID and then packets having IDs that have a predetermined priority are cumulatively counted for each ID.

10. The method according to claim 6, wherein in the calculating of the check value, a check value S is calculated using the following [Equation B]:

S=log₂(t_c−

t_ID). 

 

[Equation B]