In-vehicle network attack detection method and apparatus

A controller area network (CAN) attack detection apparatus connected to a CAN bus for in-vehicle communication, the apparatus comprising:

• a CAN driver including a first microprocessor and configured to:
• sense and manage an obstacle of the CAN bus;
• transmit a physical message to the CAN bus;
• and
• receive the physical message from the CAN bus;
• a CAN controller including a second microprocessor and configured to:
• transmit a protocol message to the CAN driver;
• and
• receive the protocol message from the CAN driver;
• a microcontroller including a third microprocessor and configured to:
• interface with the CAN controller;
• and
• provide various applications;
• wherein at least one of the microcontroller or the CAN controller is configured to execute:
• a learning module configured to generate learning statistical information expressed as bits upon receiving a predefined CAN packet, by extracting a bit stream of the predefined CAN packet matching a template region configured in units of fields constituting a CAN data frame;
• a profiling module configured to maintain the generated learning statistical information and a precollected attack type;
• and
• a detection module configured to:
• extract a bit stream matching the template region from a real-time input CAN packet,
• determine a weight parameter of a connection line between nodes of a neural network using the generated learning statistical information for the template region,
• input the extracted bit stream to an input layer of the neural network, and
• determine whether an attack is detected, based on an output value from an output layer of the neural network,
• wherein the output value from the output layer is calculated by a nonlinear combination of an output value of at least one hidden layer of the neural network.

A method for detecting an attack on a controller area network (CAN) by a CAN attack detection apparatus connected to a CAN bus for in-vehicle communication, the method comprising:

• sensing and managing, by a CAN driver, an obstacle of the CAN bus;
• transmitting, by the CAN driver, a physical message to the CAN bus;
• receiving, by the CAN driver, the physical message from the CAN bus;
• transmitting, by a CAN controller, a protocol message to the CAN driver;
• receiving, by the CAN controller, the protocol message from the CAN driver;
• interfacing, by a microcontroller, with the CAN controller and providing various applications;
• identifying, by at least one of the microcontroller or the CAN controller, a CAN identifier (ID) upon receiving a predefined CAN packet and generating and storing learning statistical information expressed as bits with respect to a data field corresponding to the identified CAN ID;
• extracting, by at least one of the microcontroller or the CAN controller of a vehicle, a CAN ID and a bit stream of a data field from a real-time input CAN packet;
• determining, by at least one of the microcontroller or the CAN controller of a vehicle, a weight parameter of a connection line between nodes of a neural network based on the learning statistical information corresponding to the extracted CAN ID;
• inputting, by at least one of the microcontroller or the CAN controller of a vehicle, the extracted bit stream to an input layer of the neural network;
• and
• determining whether an attack is detected, based on an output value from an output layer of the neural network,
• wherein the output value from the output layer is calculated by a nonlinear combination of an output value of at least one hidden layer of the neural network.

A method for detecting an attack on a controller area network (CAN) by a CAN attack detection apparatus connected to a CAN bus for in-vehicle communication, the method comprising:

• sensing and managing, by a CAN driver, an obstacle of the CAN bus;
• transmitting, by the CAN driver, a physical message to the CAN bus;
• receiving, by the CAN driver, the physical message from the CAN bus;
• transmitting, by a CAN controller, a protocol message to the CAN driver;
• receiving, by the CAN controller, the protocol message from the CAN driver;
• interfacing, by a microcontroller, with the CAN controller and providing various applications;
• generating and storing, by at least one of the microcontroller or the CAN controller, learning statistical information expressed as bits upon receiving a predefined CAN packet, by extracting a bit stream of the predefined CAN packet matching a template region configured in units of fields constituting a CAN data frame;
• and
• extracting, by at least one of the microcontroller or a CAN controller of the vehicle, a bit stream matching the template region from a real-time input CAN packet, determining a weight parameter of a connection line between nodes of a neural network using the generated learning statistical information for the template region, inputting the extracted bit stream to an input layer of the neural network, and determining whether an attack is detected, based on an output value from an output layer of the neural network,
• wherein the output value from the output layer is calculated by a nonlinear combination of an output value of at least one hidden layer of the neural network.