Apparatus and method for constructing intrusion detection system applied to CAN communication using detection policy rule

An apparatus for constructing an intrusion detection system applied to controller area network (CAN) communication, comprising:

• an input file analysis unit that extracts standard information by parsing an input file associated with the CAN communication;
• a policy setting unit that sets a policy rule by applying a static ruleset and a custom ruleset using the extracted standard information, wherein the custom ruleset is a set of policy rules whose descriptions are determined by a user;
• and
• a policy file creation unit that generates a policy file to be applied to the intrusion detection system by packing the standard information and the policy rule,
• wherein the standard information includes at least one of electronic control unit (ECU) information, protocol data unit (PDU) information, message information, signal information, bus information, or any combination thereof,
• wherein the policy rule includes at least one of a first detection policy associated with the bus information, a second detection policy associated with the message information, and a third detection policy associated with the signal information,
• wherein each of the first detection policy, the second detection policy, and the third detection policy is independent of each other according to the setting of the policy rule,
• wherein the policy setting unit defines a-custom parameters applicable as the custom ruleset and determines at least one of a combination of the custom parameters and a set value, and
• wherein the custom parameters include a first parameter for detecting when one or more wheels are rotating while a shift lever is located in park, a second parameter for detecting when there is an abnormal difference in a rotation speed of each wheel, a third parameter for detecting abnormal situations where a hot wire and a ventilating seat are turned on simultaneously, a fourth parameter for detecting when the one or more wheels rotate in a front direction while the shift lever is in reverse, a fifth parameter for detecting when a torque request value is a physically impossible value, and a sixth parameter for detecting when an engine temperature is outside of a normal range.

An apparatus for constructing an intrusion detection system applied to controller area network (CAN) communication, comprising:

• at least one memory comprising instructions and at least one hardware processor to execute the instructions within at least one memory to implement:
• extracting standard information by parsing an input file associated with the CAN communication;
• setting a policy rule by applying a static ruleset and a custom ruleset using the extracted standard information, wherein the custom ruleset is a set of policy rules whose descriptions are determined by a user;
• and
• creating a policy file to be applied to the intrusion detection system by packing the standard information and the policy rule,
• wherein the standard information includes at least one of electronic control unit (ECU) information, protocol data unit (PDU) information, message information, signal information, bus information, or any combination thereof,
• wherein the policy rule includes at least one of a first detection policy associated with the bus information, a second detection policy associated with the message information, and a third detection policy associated with the signal information,
• wherein each of the first detection policy, the second detection policy, and the third detection policy is independent of each other according to the setting of the policy rule,
• wherein the setting of the policy rule includes:
• defining custom parameters applicable as the custom ruleset;
• and
• determining at least one of a combination of the custom parameters and a set value, and
• wherein the custom parameters include a first parameter for detecting when one or more wheels are rotating while a shift lever is located in park, a second parameter for detecting when there is an abnormal difference in a rotation speed of each wheel, a third parameter for detecting abnormal situations where a hot wire and a ventilating seat are turned on simultaneously, a fourth parameter for detecting when the one or more wheels rotate in a front direction while the shift lever is in reverse, a fifth parameter for detecting when a torque request value is a physically impossible value, and a sixth parameter for detecting when an engine temperature is outside of a normal range.