Method and device for intrusion detection in a computer network

A device for intrusion detection in a computer network,

• wherein the device a system on a chip system, which includes a hardware switch unit, a hardware filter, a register, and a computing device for the intrusion detection, the device being configured to:
• receive a data packet at an input of the hardware switch unit;
• select an output of the hardware switch unit for sending the data packet or a copy of the data packet as a function of security layer information from the data packet and as a function of a hardware address;
• determine, by the hardware switch unit, context information for the data packet;
• compare, by the hardware filter of the hardware switch unit, an actual value from a field of the data packet with a set point value for values from the field, the field including security layer data or mediation layer data;
• trigger an interrupt for the computing device as a function of a result of the comparison;
• carry out by the computing device, triggered by the interrupt, an analysis for detecting an intrusion pattern in a network traffic in the computer network as a function of the context information for the data packet;
• wherein the computer network is an automotive network;
• wherein the context information for the data packet, determined by the hardware switch unit, is stored in a register, a register access of the microprocessor to the register taking place for the analysis;
• and
• wherein presence of a deviation is detected when:
• (i) a Dynamic Host Configuration Protocol filter at the input or the output establishes a Dynamic Host Configuration Protocol packet for Internet Protocol Version 4 and/or for Internet Protocol Version 6 including Dynamic Host Configuration Protocol port 67 and/or port 68;
• or
• (ii) a Transmission Control Protocol or User Datagram Protocol filter at the input or the output establishes a Transmission Control Protocol or User Datagram Protocol Broadcast message for Internet Protocol Version 4 and/or for Internet Protocol Version 6;
• or
• (iii) a Precision Time Protocol filter at the input or the output establishes a Precision Time Protocol message, a time stamp, or sequence number, or correction field, being stored at least temporarily in the register for context information.

A non-transitory computer-readable memory medium on which is stored a computer program for intrusion detection in a computer network, the computer program, when executed by a computer, causing the computer to perform or control the following steps:

• receiving a data packet at an input of a hardware switch unit;
• selecting an output of the hardware switch unit for sending the data packet or a copy of the data packet as a function of security layer information from the data packet and as a function of a hardware address;
• determining, by the hardware switch unit, context information for the data packet;
• comparing, by a hardware filter of the hardware switch unit, an actual value from a field of the data packet with a set point value for values from the field, the field including security layer data or mediation layer data;
• triggering an interrupt for a microprocessor as a function of a result of the comparison;
• carrying out by the microprocessor, triggered by the interrupt, an analysis for detecting an intrusion pattern in a network traffic in the computer network as a function of the context information for the data packet;
• wherein the network is an automotive network;
• wherein the context information for the data packet, determined by the hardware switch unit, is stored in a register, a register access of the microprocessor to the register taking place for the analysis;
• and
• wherein presence of a deviation is detected when:
• (i) a Dynamic Host Configuration Protocol filter at the input or the output establishes a Dynamic Host Configuration Protocol packet for Internet Protocol Version 4 and/or for Internet Protocol Version 6 including Dynamic Host Configuration Protocol port 67 and/or port 68;
• or
• (ii) a Transmission Control Protocol or User Datagram Protocol filter at the input or the output establishes a Transmission Control Protocol or User Datagram Protocol Broadcast message for Internet Protocol Version 4 and/or for Internet Protocol Version 6;
• or
• (iii) a Precision Time Protocol filter at the input or the output establishes a Precision Time Protocol message, a time stamp, or sequence number, or correction field, being stored at least temporarily in the register for context information.