Back to results
US 2022/0012331 A1Published application
Re-Training Intrusion Detection Fingerprints in the Presence of an Attacker
AssigneeIntel Corporation
InventorsShabbir Ahmed, Marcio Juliato, Vuk Lesi, Qian Wang, Manoj Sastry
Life of this patent
Estimating the term…
Abstract
Systems, apparatuses, and methods to establish ground truth for an intrusion detection system in the presence of an attacker electronic control unit transmitting masqueraded messages on a communication bus, such as an in-vehicle network bus, are provided.
Claims24
A method, comprising:
- generating an equalized distribution from one or more authentic messages transmitted, by an attacked electronic control unit (ECU), with a unique message identification (MID) based on a number of expected authentic messages and a total number of a plurality of messages received with the unique MID;
- subtracting the equalized distribution from an accumulated distribution for messages transmitted with the unique MID to generate an attacker distribution;
- determining, for one or more of a plurality of other distributions, whether an error between the attacker distribution and a one of the plurality of other distributions is less than or equal to a threshold error;
- and
- generating a retrained distribution for the unique MID based on a difference between the attacker distribution and the accumulated distribution for messages transmitted with the unique MID responsive to a determination that the error between the attacker distribution and the one of the plurality of other distributions is less than or equal to the threshold error.
2 more elements
A computing apparatus comprising:
- a processing circuitry;
- and
- a memory storing instructions that, when executed by the processing circuitry, cause the apparatus to:
- generate an equalized distribution from one or more authentic messages transmitted, by an attacked electronic control unit (ECU), with a unique message identification (MID) based on a number of expected authentic messages and a total number of a plurality of messages received with the unique MID;
- subtract the equalized distribution from an accumulated distribution for messages transmitted with the unique MID to generate an attacker distribution;
- determine, for one or more of a plurality of other distributions, whether an error between the attacker distribution and a one of the plurality of other distributions is less than or equal to a threshold error;
- and
- generate a retrained distribution for the unique MID based on a difference between the attacker distribution and the accumulated distribution for messages transmitted with the unique MID responsive to a determination that the error between the attacker distribution and the one of the plurality of other distributions is less than or equal to the threshold error.
5 more elements
A non-transitory computer-readable storage medium, the computer-readable storage medium including instructions that when executed by processing circuitry of an intrusion detection system (IDS), cause the IDS to:
- generate an equalized distribution from one or more authentic messages transmitted, by an attacked electronic control unit (ECU), with a unique message identification (MID) based on a number of expected authentic messages and a total number of a plurality of messages received with the unique MID;
- subtract the equalized distribution from an accumulated distribution for messages transmitted with the unique MID to generate an attacker distribution;
- determine, for one or more of a plurality of other distributions, whether an error between the attacker distribution and a one of the plurality of other distributions is less than or equal to a threshold error;
- and
- generate a retrained distribution for the unique MID based on a difference between the attacker distribution and the accumulated distribution for messages transmitted with the unique MID responsive to a determination that the error between the attacker distribution and the one of the plurality of other distributions is less than or equal to the threshold error.
2 more elements
Dependencies are inferred from the claim text.