KR102011020B1 - Device for detecting anomaly of vehicle networks based on hazard model - Google Patents

Abstract

An abnormality indication detection apparatus of a vehicle is disclosed. The detection device may include a message receiver for receiving a plurality of messages sequentially generated in a vehicle network, an ID extractor for extracting IDs of the plurality of messages, and calculating a section survival rate for each ID using the extracted plurality of IDs. It includes a survival rate calculation unit and abnormality detection unit for determining the presence or absence of abnormal symptoms based on the calculated interval survival rate.

Description

Vehicle network anomaly detection device based on hazard model {DEVICE FOR DETECTING ANOMALY OF VEHICLE NETWORKS BASED ON HAZARD MODEL}

The present invention relates to an apparatus for detecting abnormal signs of a vehicle or a vehicle network, and more particularly, to an apparatus for detecting abnormal signs based on a survival rate for each section of a message generated in a vehicle network using a hazard model. will be.

As technology for vehicles converges with Information and Communication Technologies (ICT), it is changing to a connected car environment. In addition, with the rapid development of technologies for autonomous driving, the importance of vehicle security is increasing. Many components and devices mounted on a vehicle are connected to an electronically controlled electronic control unit (ECU), which effectively controls and manages the vehicle. However, these ECUs need to take security measures because they exchange messages with other sensors and components in the vehicle through various communication protocols such as a controller area network (CAN) and a local interconnect network (LIN).

In particular, autonomous cars need less research from outside and inside because they have less driver's involvement. In the case of self-driving cars, a lot of techniques for detecting and avoiding obstacles by themselves are being developed, and are being further developed. In addition, various techniques are being developed to identify obstacles on the road and suddenly entering vehicles to avoid them in advance.

Republic of Korea Patent Publication No. 1998-0038543 (published Aug. 05, 1998) Republic of Korea Patent Publication No. 194-0011939 Republic of Korea Patent Publication No. 2016-0014026 (2016.02.05.published)

The technical problem to be achieved by the present invention is to provide a method and apparatus for detecting abnormal signs that are not dependent on CAN ID that does not require each CAN ID interpretation to detect abnormal signs of a vehicle.

An apparatus for detecting abnormality signs of a vehicle according to an exemplary embodiment of the present invention includes a message receiver configured to receive a plurality of messages sequentially generated in a vehicle network, an ID extractor configured to extract IDs of the plurality of messages, and a plurality of extracted IDs. It includes a survival rate calculation unit for calculating the interval survival rate for each ID by using the abnormality detection unit for determining the presence or absence of abnormal symptoms based on the calculated interval survival rate.

According to the present invention, it is possible to solve the difficulty of interpreting the CAN message configured differently according to the manufacturer and the year of manufacture of the vehicle, it is possible to provide a non-dependent abnormality detection technique for CAN ID that does not require CAN ID analysis.

In addition, it is possible to use the communication protocol with ID because the survival rate by ID for the CAN network of the vehicle can be used.In the case of the vehicle using the CAN network communication, the abnormality detection can be detected regardless of the type of vehicle. There is.

In addition, it quickly processes information necessary for decision making, and informs drivers and passengers of whether the vehicle is normal or abnormal, and informs the vehicle control center or the vehicle control company about whether the current vehicle is in an abnormal state. Specific response can be made possible.

The detailed description of each drawing is provided in order to provide a thorough understanding of the drawings cited in the detailed description of the invention.
1 illustrates a system according to an embodiment of the present invention.
FIG. 2 is a functional block diagram of the detection apparatus shown in FIG. 1.
3 is a view for explaining a section divided by the survival rate calculator shown in FIG. 2, FIG. 3A shows a CAN ID generated in normal driving, and FIG. 3B shows a CAN ID generated in abnormal driving.
4 is a diagram showing interval survival when the number of CAN IDs included in the chunk is different. FIG. 4A is a section survival rate when there is a DoS attack, and FIG. 4B is a section survival rate when there is a fuzzing attack. 4c shows the interval survival rate when there is an RPM attack, and FIG. 4D shows the interval survival rate when there is a gear attack.
5 is a diagram illustrating a CAN ID cycle of a sonata produced in 2010 by Hyundai Motor.
Figure 6 shows the results of measuring the detection accuracy by attack type for the 2010 Sonata vehicle of Hyundai.

Specific structural or functional descriptions of the embodiments according to the inventive concept disclosed herein are provided only for the purpose of describing the embodiments according to the inventive concept. It may be embodied in various forms and is not limited to the embodiments described herein.

Embodiments according to the inventive concept may be variously modified and have various forms, so embodiments are illustrated in the drawings and described in detail herein. However, this is not intended to limit the embodiments in accordance with the concept of the invention to the specific forms disclosed, it includes all changes, equivalents, or substitutes included in the spirit and scope of the present invention.

Terms such as first or second may be used to describe various components, but the components should not be limited by the terms. The terms are used only for the purpose of distinguishing one component from another, for example without departing from the scope of the rights according to the inventive concept, and the first component may be called a second component and similarly the second component. The component may also be referred to as a first component.

When a component is said to be "connected" or "connected" to another component, it may be directly connected to or connected to that other component, but it may be understood that other components may exist in the middle. Should be. On the other hand, when a component is said to be "directly connected" or "directly connected" to another component, it should be understood that no other component exists in the middle. Other expressions describing the relationship between components, such as "between" and "immediately between" or "neighboring to" and "directly neighboring", should be interpreted as well.

The terminology used herein is for the purpose of describing particular example embodiments only and is not intended to be limiting of the invention. Singular expressions include plural expressions unless the context clearly indicates otherwise. In this specification, terms such as "comprise" or "have" are intended to indicate that there is a feature, number, step, action, component, part, or combination thereof described herein, but one or more other features. It is to be understood that the present invention does not exclude the possibility of the presence or the addition of numbers, steps, operations, components, parts, or combinations thereof.

Unless defined otherwise, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art. Terms such as those defined in the commonly used dictionaries should be construed as having meanings consistent with the meanings in the context of the related art, and are not construed in ideal or excessively formal meanings unless expressly defined herein. Do not.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.

The present invention is a method for detecting an abnormal vehicle state that can occur in an autonomous driving environment or a vehicle Internet of Things (IoT) environment on the client side, and can determine whether the vehicle state is safe by applying a hazard model technique. Present the way.

The vehicle communicates using a controller area network (CAN) protocol to communicate with various vehicle components and sensors mounted on the vehicle. CAN messages are continuously generated from each sensor and component and collected in the ECU, and with this data the vehicle performs its function.

Vehicle status information and vehicle control information move inside the vehicle through the CAN network. Detecting such CAN messages for abnormalities and attacks is essential for the safety of the vehicle and the driver's safety.

The CAN message transmitted from the CAN network is different from the manufacturer and the manufacturing year of each vehicle in the case of raw data, and the parts generated and applied to components in the vehicle are configured differently. That is, even the same CAN ID can perform different functions depending on the vehicle.

In particular, in autonomous driving environment, CAN message data generated during driving will be generated periodically and repetitively.In passive and passive driving environment from the driver's perspective, the condition of the vehicle is periodically monitored, and abnormal signals are detected and alarmed. You will need an immediate system.

In addition, the present invention detects abnormal signs of the vehicle by using a hazard model (Hazard Model). Hazard model is a statistical technique for estimating the survival function or survival curve by analyzing the survival period, and is a method for analyzing the period until the event occurs. Survival period and current state information are required, and the current state here refers to checking whether the object to be measured is alive at the time point of survival measurement.

There are three methods for estimating the survival function or survival curves: life table method, Kaplan-Meier, and Cox proportional hazard model. However, in the present invention, the Kaplan-Meier concept is applied to detect abnormal symptoms.

)을 측정할 수 있다.The Kaplan-Meier estimation method is used to organize the data in the order of observation period (time or chunks), and then, as the ratio of the survivors among the number of observations,

) Can be measured.

When the vehicle is running normally, the survival probability of individual CAN IDs generated while driving is mostly kept constant.However, when DoS (Denial of Service), Fuzzing, and Spoofing attacks occur while driving, The pattern of change in the probability of survival occurs.

Table 1 shows the types of attacks that can occur inside a vehicle using the CAN protocol.

Attack type Contents DoS DoS attacks occupy all resources allocated to the in-vehicle CAN bus, limiting communication between ECUs in the vehicle and delaying or blocking the transmission of CAN messages to perform the original functions of the attacking vehicle that hinder normal operation.
Inject CAN messages into the vehicle indefinitely by setting the Arbitration ID of the CAN message to 0 or lower than the value used in the target vehicle. Fuzzing attack Arbitration ID, data, and DLC to be included in the CAN message are randomly determined each time and sent to the vehicle
Injection messages of totally random CAN ID and DATA values every 0.5 milliseconds. Spoofing attack
(RPM / Gear) Injecting messages of certain CAN ID related to RPM / gear information every 1 millisecond.

1 illustrates a system according to an embodiment of the present invention.

Referring to FIG. 1, a system 10, which may be a vehicle system, includes a plurality of ECUs (Electronic Control Units, ECUA through ECU D), and a detection device 100. Each of the ECUs ECUA to ECUD or the detection device 100 may communicate through a controller area network (CAN). That is, each ECU (ECUA to ECUD) or the detection device 100 may send or receive a message or data by broadcasting a CAN message on a CAN bus. In addition, it will be apparent to those skilled in the art that the scope of the present invention is not limited to the number of ECUs included in the system 10.

The detection apparatus 100 may receive CAN messages broadcast through the CAN bus and detect abnormal signs of the vehicle by using CAN IDs of the CAN messages. 1 illustrates a detection device 100 implemented as an ECU, but according to an embodiment, the detection device 100 may be implemented as a separate device, and may be implemented through an OBD-2 (On Board Diagnostics-2) terminal. You can also receive a message.

In addition, the system 10 is not limited to a CAN network system, and according to an embodiment, a communication protocol or a network used in the system 10 may be a FlexRay, a local interconnect network (LIN), or a CAN FD ( Flexible Data) or Most (Media Oriented Systems Transport, MOST). In this case, the detection apparatus 100 may detect an abnormal indication of a vehicle or an abnormal indication of a vehicle network by extracting an ID of a message generated from each network.

FIG. 2 is a functional block diagram of the detection apparatus shown in FIG. 1.

1 and 2, the detection apparatus 100 includes a message receiver 110, an ID extractor 130, a survival rate calculator 150, and an abnormality indication detector 170. According to an embodiment, the detection apparatus 100 may further include a storage 190.

The message receiver 110 may receive a plurality of CAN messages broadcast through the CAN bus. The message receiving unit 110 may be directly connected to a CAN bus to receive the plurality of CAN messages, or may receive the plurality of CAN messages through an OBD-2 terminal. The plurality of CAN messages received by the message receiver 110 may be stored in the storage 190.

The ID extractor 130 may extract a CAN ID of each of the plurality of messages received by the message receiver 110 or the plurality of messages stored in the storage 190. The ID extracted by the ID extractor 130 may be stored in the storage.

)을 산출할 수 있다. 생존율 산출부(150)에 의해 산출된 각 CAN ID의 구간 생존율(

)은 저장부(190)에 저장될 수 있다. 생존율 산출부(150)의 구체적인 동작은 후술하기로 한다.The survival rate calculator 150 divides sequentially generated CAN IDs or sequentially broadcast CAN IDs into predetermined sections, and in each of the divided sections, the survival rate of each of at least one CAN ID predetermined (

) Can be calculated. The interval survival rate of each CAN ID calculated by the survival rate calculation unit 150 (

) May be stored in the storage 190. The detailed operation of the survival rate calculator 150 will be described later.

)에 기초하여 차량의 이상 징후 여부(또는 차량 네트워크의 이상 징후 여부)를 탐지할 수 있다. 구체적으로, CAN ID의 미리 정해진 범위를 벗어나는 경우 차량에 이상 징후가 발생한 것으로 판단할 수 있다. 일 예로, CAN ID "4f0"의 구간 생존율이 0.1~0.3을 벗어나는 경우 이상 징후로 판단할 수 있다.The abnormal symptom detection unit 170 calculates the interval survival rate of each calculated CAN ID (

) Can detect whether the vehicle has an abnormality (or whether the vehicle network has an abnormality). In detail, when it is out of the predetermined range of the CAN ID, it may be determined that an abnormal symptom occurs in the vehicle. For example, when the interval survival rate of the CAN ID "4f0" is more than 0.1 ~ 0.3 may be determined as an abnormal symptom.

In addition, the abnormal symptom detection unit 170 may transmit a notification message when the abnormal symptom occurs in the vehicle. According to an embodiment, the anomaly detection detector may broadcast the notification message through a CAN bus or transmit it to a separate server through a separate wired / wireless communication network. In addition, since the abnormal signs of the vehicle are determined based on the interval survival rate of the individual CAN ID, a warning message may be specifically provided as to which CAN ID a problem occurs.

The storage 190 includes a plurality of CAN messages received by the message receiving unit 110, a plurality of CAN IDs extracted by the ID extracting unit 130, and / or each calculated by the survival rate calculating unit 150. The interval survival rate of the CAN ID may be stored.

Each of the components of the detection apparatus 100 illustrated in FIG. 2 is represented as being functionally and logically separated, and does not necessarily mean that each component is divided into separate physical devices or written in separate codes. The average expert in the art will be able to reason easily.

In addition, in the present specification, "~ part" may mean a functional and structural combination of hardware for performing the technical idea of the present invention and software for driving the hardware. For example, the term "~ part" may mean a logical unit of a predetermined code and a hardware resource for performing the predetermined code, and does not necessarily mean a physically connected code or a kind of hardware. .

3 is a view for explaining a section divided by the survival rate calculator shown in FIG. 2, FIG. 3A shows a CAN ID generated in normal driving, and FIG. 3B shows a CAN ID generated in abnormal driving.

1 to 3, the survival rate calculator 150 may set the chunk to include a predetermined number of CAN messages (or CAN IDs) that are sequentially generated (or broadcast or received). Herein, the chunk refers to a section including a predetermined CAN ID, and the time period may be different for each chunk.

As an example, the survival rate calculator 150 may set a section, that is, a chunk, to include 20 CAN IDs. In this case, in FIG. 3, each chunk is set not to include CAN IDs redundantly. However, according to an embodiment, each chunk may be set such that an arbitrary chunk and a previous chunk overlap a predetermined ratio or a predetermined number of CAN IDs. have.

As another example, the survival rate calculator 150 may set a section based on time. In detail, the survival rate calculator 150 may set a section to have a (a is a real number of 0 or more) seconds. In this case, the number of CAN IDs included in each section may be different from each other. In this case, each section may be set so that a predetermined section or a predetermined time overlaps with the previous section.

In addition, the survival rate calculator 150 may calculate a section survival rate of at least one CAN ID predetermined in each section.

In the case of normal driving (FIG. 3A), the interval survival rate of the CAN ID "4f0" in the first chunk (chunk1) to the fourth chunk (chunk4) is as follows.

Interval survival rate P (t) of CAN ID 4f0 on chunk1 = 5/20 = 0.25

Interval survival rate P (t) of CAN ID 4f0 on chunk2 = 5/20 = 0.25

Interval survival rate P (t) of CAN ID 4f0 on chunk3 = 4/20 = 0.2

Interval survival rate P (t) of CAN ID 4f0 on chunk4 = 4/20 = 0.2

As described above, the interval survival rate of the CAN ID in normal driving is kept constant, but when the injection attack such as DoS is performed, the interval survival rate is different.

In the case of abnormal driving (FIG. 3B), the interval survival rate of the CAN ID "4f0" in the first chunk (chunk1) to the fourth chunk (chunk4) is as follows.

Interval survival rate P (t) of CAN ID 4f0 on chunk1 = 5/20 = 0.25

Interval survival rate P (t) of CAN ID 4f0 on chunk2 = 5/20 = 0.25

Interval survival rate P (t) of CAN ID 4f0 on chunk3 = 1/20 = 0.05

Interval survival rate P (t) of CAN ID 4f0 at chunk4 = 1/20 = 0.05

4 is a diagram showing interval survival when the number of CAN IDs included in the chunk is different. FIG. 4A is a section survival rate when there is a DoS attack, and FIG. 4B is a section survival rate when there is a fuzzing attack. 4c shows the interval survival rate when there is an RPM attack, and FIG. 4D shows the interval survival rate when there is a gear attack.

It was confirmed that the section survival rate varies depending on the type of attack on the actual vehicle. When one chunk was divided into 100 CAN IDs, the survival rate of each section of the CAN ID corresponding to each attack was measured sequentially up to 300.

Referring to FIG. 4A, when DoS attacks are performed with CAN ID "0000", the survival rate (red) of CAN ID "04f0" and the survival rate (gray) of CAN ID "04f0" when there is no attack clearly differ. Can be.

Referring to FIG. 4B, it can be seen that the survival rate (red) of CAN ID “04f0” when the fuzzing attack is performed and the survival rate (grey) of CAN ID “04f0” when there is no attack are clearly different.

Referring to FIG. 4c, it can be seen that the survival rate (red) of CAN ID "0316" and the survival rate (grey) of CAN ID "0316" when there is no attack when RPM RPM is performed with CAN ID "0316" are clearly different. Can be.

Referring to FIG. 4D, it can be seen that the survival rate (red) of CAN ID "0329" and the survival rate (gray) of CAN ID "0329" when there is no attack when Gear attack is performed with CAN ID "0329" are clearly different. Can be.

The lower the CAN ID number, the higher the CAN message cycle. Higher priority means that the higher priority CAN ID is executed first in CAN, a broadcast-oriented communication protocol. Referring to FIG. 5, which illustrates the CAN ID cycle of the Sonata manufactured by Hyundai Motor in 2010, it can be seen that the cycle is very constant except for some CAN IDs (690, 5a0, 5a2, 5f0, etc.). In view of the constantity of the CAN ID period, the inventors of the present invention have proposed a method of detecting abnormal signs of the vehicle only with the interval survival rate of the CAN ID.

Referring to FIG. 6, which shows the result of measuring the detection accuracy of each type of attack on a 2010 Sonata vehicle of Hyundai Motor, it can be seen that the present invention provides very high accuracy.

Although the present invention has been described with reference to the embodiments illustrated in the drawings, this is merely exemplary, and it will be understood by those skilled in the art that various modifications and equivalent other embodiments are possible. Therefore, the true technical protection scope of the present invention will be defined by the technical spirit of the appended claims.

10: system
100: detection device
110: message receiving unit
130: ID extraction unit
150: survival rate calculation unit
170: anomaly detection unit
190: storage unit

Claims (7)

A message receiver configured to receive a plurality of messages sequentially generated in the vehicle network;
An ID extracting unit for extracting IDs of each of the plurality of messages;
A survival rate calculator for calculating interval survival rates for each ID using the extracted plurality of IDs; And
An abnormal indication detection unit for determining the presence or absence of abnormal signs based on the calculated interval survival rate,
The survival rate calculator divides the plurality of IDs into a predetermined section, calculates a section survival rate of at least one ID in each of the divided sections,
The survival rate calculating unit divides the intervals such that a plurality of IDs or a predetermined number of IDs are overlapped in two consecutive sections.
Anomaly detection device of a vehicle.
The method of claim 1,
The vehicle network is a controller area network (CAN),
Each of the plurality of messages is a CAN message,
Anomaly detection device of a vehicle.
delete The method of claim 1,
The survival rate calculator divides the plurality of IDs so that each divided section has the same time period.
Anomaly detection device of a vehicle.
The method of claim 1,
The survival rate calculating unit divides the plurality of IDs so that the same number of IDs are included in each divided section,
Anomaly detection device of a vehicle.
The method of claim 1,
The abnormal symptom detection unit determines that an abnormal symptom occurs when the calculated interval survival rate is out of a predetermined range,
Anomaly detection device of a vehicle.
The method of claim 1,
The vehicle network is CAN FD (Flexible Data), FlexRay, LIN (Local Interconnect Network) or MOST (Media Oriented Systems Transport),
Anomaly detection device of a vehicle.

Images