# US 10,484,401 B2 · In-vehicle network attack detection method and apparatus

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,484,401 B2
- Document ID: US10484401B2
- Status: Granted
- Kind: B2
- Application number: 15/202,255
- Filed: 2016-07-05
- Published: 2017-05-04
- Granted: 2019-11-19
- Earliest claimed: 2015-10-30
- Assignees: Hyundai Motor Company; Kia Motors Corporation; Ewha University-Industry Collaboration Foundation
- Applicants: Hyundai Motor Company; Kia Motors Corporation; Ewha University—Industry Collaboration Foundation
- Inventors: Ho Jin Jung; Hyun Soo Ahn; Je Won Kang; Min Joo Kang
- Web page: https://patentgrep.com/patent/US10484401B2

## CPC

- H04L 63/1416: {Event detection, e.g. attack signature detection}
- B60R 16/0231: {Circuits relating to the driving or the functioning of the vehicle (monitoring tyres B60C23/00; indicating overspeed B60K31/00; for dash boards B60K37/00, B60Q3/10; for indicating emergencies B60Q1/52; brake control systems B60T; registering or indicating the working of vehicles G07C5/00; measuring distance G01C, e.g. combinations of speed and distance G01C23/00; engine indicators G01L; measuring speed or acceleration G01P)}
- G05B 15/02: electric
- G06N 3/047: Probabilistic or stochastic networks
- G06N 3/0499: Feedforward networks
- G06N 3/08: Learning methods
- G06N 3/09: Supervised learning
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- H04L 67/12: specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- B60R: VEHICLES, VEHICLE FITTINGS, OR VEHICLE PARTS, NOT OTHERWISE PROVIDED FOR
- G05B: CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS (systems for controlling or regulating non-electric variables G05D; systems for regulating electric or magnetic variables G05F; control devices or systems insofar as characterised by mechanical features only G05G)
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS

## Abstract

The present disclosure provides a vehicle controller area network (CAN) communication attack detection method and apparatus. The apparatus includes: a learning module, a profiling module, and a detection module. The learning module identifies a CAN identifier (ID) upon receiving a predefined CAN packet and generates learning statistical information expressed as bits with respect to a data field corresponding to the identified CAN ID. The profiling module maintains the learning statistical information received and a precollected attack type, and the detection module extracts a CAN ID and a bit stream of a data field from a real-time input CAN packet. In addition, the detection module configures a neural network by acquiring the learning statistical information from the profiling module, inputs the extracted bit stream to the configured neural network, and determines whether attack is detected, based on an output value of the neural network.

## Claims

### Claim 1

A controller area network (CAN) attack detection apparatus connected to a CAN bus for in-vehicle communication, the apparatus comprising:
a CAN driver including a first microprocessor and configured to:
sense and manage an obstacle of the CAN bus;
transmit a physical message to the CAN bus; and
receive the physical message from the CAN bus;
a CAN controller including a second microprocessor and configured to:
transmit a protocol message to the CAN driver; and
receive the protocol message from the CAN driver;
a microcontroller including a third microprocessor and configured to:
interface with the CAN controller; and
provide various applications;
wherein at least one of the microcontroller or the CAN controller is configured to execute:
a learning module configured to identify a CAN identifier (ID) upon receiving a predefined CAN packet and to generate learning statistical information expressed as bits with respect to a data field corresponding to the identified CAN ID;
a profiling module configured to maintain the learning statistical information received from the learning module and a precollected attack type; and
a detection module configured to:
extract a CAN ID and a bit stream of a data field from a real-time input CAN packet, and
determine a weight parameter of a connection line between nodes of a neural network using the learning statistical information acquired from the profiling module,
input the extracted bit stream to an input layer of the neural network, and
determine whether an attack is detected, based on an output value from an output layer of the neural network,
wherein the output value from the output layer is calculated by a nonlinear combination of an output value of at least one hidden layer of the neural network.

### Claim 2 (depends on 1)

The apparatus according to claim 1, wherein the detection module is configured to transmit the real-time input CAN packet to the profiling module upon determining that the attack is detected according to the output value from the output layer, and the profiling module is configured to update the precollected attack type using a CAN packet detected as an attack packet.

### Claim 3 (depends on 1)

The apparatus according to claim 1, wherein the detection module determines whether the attack is detected by determining whether the real-time input CAN packet is a CAN packet corresponding to the precollected attack type.

### Claim 4 (depends on 1)

The apparatus according to claim 1, wherein the learning module is configured to extract an interest point based on the learning statistical information expressed as the bits.

### Claim 5 (depends on 4)

The apparatus according to claim 4, wherein the learning module is configured to select at least one partial specific bit stream in the bit stream of the data field as the interest point.

### Claim 6 (depends on 5)

The apparatus according to claim 5, wherein the detection module is configured to input a bit stream corresponding to the selected interest point to the neural network.

### Claim 7 (depends on 5)

The apparatus according to claim 5, wherein the interest point includes at least one of a bit stream expressing mode information and a bit stream expressing number information.

### Claim 8 (depends on 4)

The apparatus according to claim 4, wherein the learning module is configured to select the interest point in units of bits based on variation of units of bits in the bit stream of the data field over time.

### Claim 9 (depends on 8)

The apparatus according to claim 8, wherein the variation of units of bits is calculated by an exclusive-OR operation on data field regions of two consecutive CAN packets.

### Claim 10 (depends on 1)

The apparatus according to claim 1, wherein the predefined CAN packet includes a CAN packet of a normal state and a CAN packet of an abnormal state.

### Claim 11

A controller area network (CAN) attack detection apparatus connected to a CAN bus for in-vehicle communication, the apparatus comprising:
a CAN driver including a first microprocessor and configured to:
sense and manage an obstacle of the CAN bus;
transmit a physical message to the CAN bus; and
receive the physical message from the CAN bus;
a CAN controller including a second microprocessor and configured to:
transmit a protocol message to the CAN driver; and
receive the protocol message from the CAN driver;
a microcontroller including a third microprocessor and configured to:
interface with the CAN controller; and
provide various applications;
wherein at least one of the microcontroller or the CAN controller is configured to execute:
a learning module configured to generate learning statistical information expressed as bits upon receiving a predefined CAN packet, by extracting a bit stream of the predefined CAN packet matching a template region configured in units of fields constituting a CAN data frame;
a profiling module configured to maintain the generated learning statistical information and a precollected attack type; and
a detection module configured to:
extract a bit stream matching the template region from a real-time input CAN packet,
determine a weight parameter of a connection line between nodes of a neural network using the generated learning statistical information for the template region,
input the extracted bit stream to an input layer of the neural network, and
determine whether an attack is detected, based on an output value from an output layer of the neural network,
wherein the output value from the output layer is calculated by a nonlinear combination of an output value of at least one hidden layer of the neural network.

### Claim 12

A method for detecting an attack on a controller area network (CAN) by a CAN attack detection apparatus connected to a CAN bus for in-vehicle communication, the method comprising:
sensing and managing, by a CAN driver, an obstacle of the CAN bus;
transmitting, by the CAN driver, a physical message to the CAN bus;
receiving, by the CAN driver, the physical message from the CAN bus;
transmitting, by a CAN controller, a protocol message to the CAN driver;
receiving, by the CAN controller, the protocol message from the CAN driver;
interfacing, by a microcontroller, with the CAN controller and providing various applications;
identifying, by at least one of the microcontroller or the CAN controller, a CAN identifier (ID) upon receiving a predefined CAN packet and generating and storing learning statistical information expressed as bits with respect to a data field corresponding to the identified CAN ID;
extracting, by at least one of the microcontroller or the CAN controller of a vehicle, a CAN ID and a bit stream of a data field from a real-time input CAN packet;
determining, by at least one of the microcontroller or the CAN controller of a vehicle, a weight parameter of a connection line between nodes of a neural network based on the learning statistical information corresponding to the extracted CAN ID;
inputting, by at least one of the microcontroller or the CAN controller of a vehicle, the extracted bit stream to an input layer of the neural network; and
determining whether an attack is detected, based on an output value from an output layer of the neural network,
wherein the output value from the output layer is calculated by a nonlinear combination of an output value of at least one hidden layer of the neural network.

### Claim 13 (depends on 12)

The method according to claim 12, further comprising:
maintaining information about a precollected attack type in a predetermined recording region and, when the attack is determined according to the output value from the output layer, updating the precollected attack type using the real-time input CAN packet.

### Claim 14 (depends on 13)

The method according to claim 13, further comprising:
sensing an attack by determining whether the real-time input CAN packet is a CAN packet corresponding to the precollected attack type.

### Claim 15 (depends on 12)

The method according to claim 12, further comprising:
extracting an interest point based on the learning statistical information expressed as bits.

### Claim 16 (depends on 15)

The method according to claim 15, wherein the extracting the interest point comprises at least one of:
selecting at least one partial specific bit stream in the bit stream in the data field as the interest point; or
selecting the interest point in units of bits based on variation of units of bits in the bit stream in the data field over time.

### Claim 17 (depends on 16)

The method according to claim 16, wherein a bit stream or a bit selected as the interest point is input to the neural network.

### Claim 18 (depends on 16)

The method according to claim 16, wherein, when the partial specific bit stream is selected as the interest point, the interest point includes at least one of a bit stream expressing mode information or a bit stream expressing number information.

### Claim 19 (depends on 16)

The method according to claim 16, wherein the variation of units of bits is calculated by an exclusive-OR operation of units of bits on data field regions of two consecutive CAN packets.

### Claim 20

A method for detecting an attack on a controller area network (CAN) by a CAN attack detection apparatus connected to a CAN bus for in-vehicle communication, the method comprising:
sensing and managing, by a CAN driver, an obstacle of the CAN bus;
transmitting, by the CAN driver, a physical message to the CAN bus;
receiving, by the CAN driver, the physical message from the CAN bus;
transmitting, by a CAN controller, a protocol message to the CAN driver;
receiving, by the CAN controller, the protocol message from the CAN driver;
interfacing, by a microcontroller, with the CAN controller and providing various applications;
generating and storing, by at least one of the microcontroller or the CAN controller, learning statistical information expressed as bits upon receiving a predefined CAN packet, by extracting a bit stream of the predefined CAN packet matching a template region configured in units of fields constituting a CAN data frame; and
extracting, by at least one of the microcontroller or a CAN controller of the vehicle, a bit stream matching the template region from a real-time input CAN packet, determining a weight parameter of a connection line between nodes of a neural network using the generated learning statistical information for the template region, inputting the extracted bit stream to an input layer of the neural network, and determining whether an attack is detected, based on an output value from an output layer of the neural network,
wherein the output value from the output layer is calculated by a nonlinear combination of an output value of at least one hidden layer of the neural network.