# US 12,603,902 B2 · Apparatus and method for constructing intrusion detection system applied to CAN communication using detection policy rule > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,603,902 B2 - Document ID: US12603902B2 - Status: Granted - Kind: B2 - Application number: 18/780,389 - Filed: 2024-07-22 - Published: 2025-03-13 - Granted: 2026-04-14 - Earliest claimed: 2023-09-13 - Assignees: Autocrypt Co., Ltd. - Applicants: Autocrypt Co., Ltd. - Inventors: Duk Soo Kim; Eui Seok Kim; Sang Gyoo Sim; Ki Ho Joo; Jung Won Lee; Jong Guk Lee; Jung Wook Kim; Sang Seok Lee; Yeong Wan Seo; Si Ho Ha; Yeong Dae Lee - Web page: https://patentgrep.com/patent/US12603902B2 ## CPC - H04L 63/1416: {Event detection, e.g. attack signature detection} - G06F 21/55: Detecting local intrusion or implementing counter-measures - H04L 2012/40215: {Controller Area Network CAN} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Disclosed are an apparatus and method for constructing an intrusion detection system applied to CAN communication. The method for constructing an intrusion detection system applied to CAN communication may include extracting standard information by parsing an input file associated with CAN communication, setting a policy rule by applying at least one of a static ruleset and a custom ruleset using the extracted standard information, and creating a policy file to be applied to the intrusion detection system by packing the standard information and the policy rule. ## Claims ### Claim 1 A method for constructing an intrusion detection system applied to controller area network (CAN) communication, comprising: extracting standard information by parsing an input file associated with the CAN communication; setting a policy rule by applying a static ruleset and a custom ruleset using the extracted standard information, wherein the custom ruleset is a set of policy rules whose descriptions are determined by a user; and creating a policy file to be applied to the intrusion detection system by packing the standard information and the policy rule, wherein the standard information includes at least one of electronic control unit (ECU) information, protocol data unit (PDU) information, message information, signal information, bus information, or any combination thereof, wherein the policy rule includes at least one of a first detection policy associated with the bus information, a second detection policy associated with the message information, and a third detection policy associated with the signal information, wherein each of the first detection policy, the second detection policy, and the third detection policy is independent of each other according to the setting of the policy rule, wherein the setting of the policy rule includes: defining custom parameters applicable as the custom ruleset; and determining at least one of a combination of the custom parameters and a set value, and wherein the custom parameters include a first parameter for detecting when one or more wheels are rotating while a shift lever is located in park, a second parameter for detecting when there is an abnormal difference in a rotation speed of each wheel, a third parameter for detecting abnormal situations where a hot wire and a ventilating seat are turned on simultaneously, a fourth parameter for detecting when the one or more wheels rotate in a front direction while the shift lever is in reverse, a fifth parameter for detecting when a torque request value is a physically impossible value, and a sixth parameter for detecting when an engine temperature is outside of a normal range. ### Claim 2 (depends on 1) The method of claim 1, wherein, in the setting of the policy rule, the static ruleset is set to include predefined parameters. ### Claim 3 (depends on 1) The method of claim 1, wherein the policy file is a policy binary. ### Claim 4 (depends on 3) The method of claim 3, wherein the policy binary is created in a hierarchical structure including policy header information, lookup table information, and policy body information. ### Claim 5 (depends on 1) The method of claim 1, wherein the policy file is applied to at least one of an intrusion detection system (IDS) core layer and an IDS detect layer of the intrusion detection system. ### Claim 6 (depends on 1) The method of claim 1, wherein the input file includes a controller area network database (CAN DBC) file. ### Claim 7 An apparatus for constructing an intrusion detection system applied to controller area network (CAN) communication, comprising: an input file analysis unit that extracts standard information by parsing an input file associated with the CAN communication; a policy setting unit that sets a policy rule by applying a static ruleset and a custom ruleset using the extracted standard information, wherein the custom ruleset is a set of policy rules whose descriptions are determined by a user; and a policy file creation unit that generates a policy file to be applied to the intrusion detection system by packing the standard information and the policy rule, wherein the standard information includes at least one of electronic control unit (ECU) information, protocol data unit (PDU) information, message information, signal information, bus information, or any combination thereof, wherein the policy rule includes at least one of a first detection policy associated with the bus information, a second detection policy associated with the message information, and a third detection policy associated with the signal information, wherein each of the first detection policy, the second detection policy, and the third detection policy is independent of each other according to the setting of the policy rule, wherein the policy setting unit defines a-custom parameters applicable as the custom ruleset and determines at least one of a combination of the custom parameters and a set value, and wherein the custom parameters include a first parameter for detecting when one or more wheels are rotating while a shift lever is located in park, a second parameter for detecting when there is an abnormal difference in a rotation speed of each wheel, a third parameter for detecting abnormal situations where a hot wire and a ventilating seat are turned on simultaneously, a fourth parameter for detecting when the one or more wheels rotate in a front direction while the shift lever is in reverse, a fifth parameter for detecting when a torque request value is a physically impossible value, and a sixth parameter for detecting when an engine temperature is outside of a normal range. ### Claim 8 (depends on 7) The apparatus of claim 7, wherein the policy setting unit sets the static ruleset to include predefined parameters. ### Claim 9 (depends on 7) The apparatus of claim 7, wherein the policy file is a policy binary created in a hierarchical structure including policy header information, lookup table information, and policy body information. ### Claim 10 An apparatus for constructing an intrusion detection system applied to controller area network (CAN) communication, comprising: at least one memory comprising instructions and at least one hardware processor to execute the instructions within at least one memory to implement: extracting standard information by parsing an input file associated with the CAN communication; setting a policy rule by applying a static ruleset and a custom ruleset using the extracted standard information, wherein the custom ruleset is a set of policy rules whose descriptions are determined by a user; and creating a policy file to be applied to the intrusion detection system by packing the standard information and the policy rule, wherein the standard information includes at least one of electronic control unit (ECU) information, protocol data unit (PDU) information, message information, signal information, bus information, or any combination thereof, wherein the policy rule includes at least one of a first detection policy associated with the bus information, a second detection policy associated with the message information, and a third detection policy associated with the signal information, wherein each of the first detection policy, the second detection policy, and the third detection policy is independent of each other according to the setting of the policy rule, wherein the setting of the policy rule includes: defining custom parameters applicable as the custom ruleset; and determining at least one of a combination of the custom parameters and a set value, and wherein the custom parameters include a first parameter for detecting when one or more wheels are rotating while a shift lever is located in park, a second parameter for detecting when there is an abnormal difference in a rotation speed of each wheel, a third parameter for detecting abnormal situations where a hot wire and a ventilating seat are turned on simultaneously, a fourth parameter for detecting when the one or more wheels rotate in a front direction while the shift lever is in reverse, a fifth parameter for detecting when a torque request value is a physically impossible value, and a sixth parameter for detecting when an engine temperature is outside of a normal range.