DE102019212820A1 - Process for evaluating and adapting network models in signal fingerprint systems - Google Patents

Abstract

The invention relates to a method for adapting a network model (200), comprising receiving (110), in an evaluation unit (62), signal parameter values of at least one signal parameter of a signal sent on a network (1); ; Creating (120) an adapted model of the electronic architecture of the network (1) on the basis of the at least one signal parameter; Comparing (130) the adapted model with a model (200) stored for the network in the evaluation unit, deciding on the basis of the comparison whether the model needs to be updated; and if the model needs to be updated, sending (150) an adapted model to a model unit in the network (1).

Description

The present invention relates to a method for adapting a network model as well as a computing unit and a computer program for its implementation.

State of the art

In order to achieve a certain level of security when transmitting messages and signals in a network, it is desirable to be able to identify the transmitter unequivocally and to be able to recognize whether the transmitted signals have been changed on the transmission path.

For this purpose, various measures are generally known in the field of network technology, for example the use of signatures or MAC (Message Authentication Code).

However, not all of them are useful in every network. For example, some systems are subject to restrictions with regard to the signal or message size, or there are only limited resources available for processing in real time.

An example of this are bus systems in vehicles. A common standard for a vehicle bus is the CAN bus, Controller Area Network, which is intended to enable fast communication between microcontrollers and devices in the system without a host computer. The CAN bus protocol is a message-based protocol on a serial bus line that was originally designed to reduce connections specifically in vehicles, but is also used in many other areas.

Especially in vehicles, secure communication is playing an increasingly important role with the progress in the field of networked and autonomous vehicles. It could be shown that vehicle controls can be attacked, especially when the systems are connected to the outside, e.g. through mobile communication interfaces. Due to the lack of authentication measures on the bus, it is relatively easy to smuggle in additional or falsified messages from outside without being recognized. Since these controls and bus systems are used in particular to control safety-critical functions such as braking functions, vulnerability from outside is particularly problematic.

A simple way of detecting attacks is to check the content and regularity of the messages on the vehicle bus, since many messages in this environment are constant or easily predictable and are often sent periodically. Nevertheless, weak points remain here which such a system cannot recognize or prevent: since messages in the CAN bus system do not contain any information about the sender, it cannot be ensured whether the message really originates from a permissible unit; and if faulty messages or messages recognized as an attack are smuggled in via one of the transmission units in the network, it is hardly possible to identify the compromised unit.

Therefore, in the DE 10 2017 208 547 A1 proposed to use some kind of physically conditioned "fingerprints" of the network or individual network components for protection. In this case, unique properties of the network nodes in the network or their transmitted signals are used to identify the sender, so that smuggled messages can be recognized on the basis of these signal properties. As soon as it is recognized with a high probability that none of the known components can be used as the sender of the message and an attack must be suspected, appropriate countermeasures can be taken, such as outputting or sending a warning signal, sending an error message on the bus or the Block the message in question.

For this purpose, for example, the clock offset that occurs in the clock frequencies of clock generators of the transmitters due to manufacturing tolerances and statistical variations can be used. Each transmitter in the bus system therefore has a specific clock offset, i.e. an invariable frequency deviation from a reference frequency.

Other signal parameters can also be used as fingerprint parameters. These include, for example, the stability of the signal, in particular in the area of the rising and falling signal edges, or the steepness of the signal edges. There, too, you will find small, transmitter-specific and stable deviations that make identification possible.

The fingerprint parameters can initially be recorded and set using suitable test messages or learned using suitable machine learning methods, so that it is known in the system which parameter value belongs to which transmitter. The measured bus signals can then be classified on a statistical basis, so that if there is a probability above a certain threshold value, they are assigned to the appropriate transmitter.

If now these sender-specific fingerprint features are considered over a longer period of time small, long-term deviations (so-called concept drift, changes in the distribution of the measurement data that lead to the predictions of the learned model no longer being valid) from the model, which are based on various effects, can arise. On the one hand, aging effects can change a physical characteristic, for example. In particular, it is also known that when considering statistical properties of a variable, the prediction becomes less precise with increasing time, so that deviations from the prediction model are unavoidable over a longer period of observation.

These changes can therefore lead to the assignment of the fingerprints to their respective senders no longer being possible with sufficient reliability. However, recognizing the long-term drift effects is not trivial, since fluctuations in the ambient conditions can also lead to temporary deviations. In order to ensure reliable detection, it is desirable to first identify the deviation using Concept Drift and, if necessary, adapt the model used, which takes over the assignment and classification of the fingerprints for attack detection, to these deviations. However, the control units, which are usually integrated in vehicle buses and similar networks, are usually not equipped with sufficient computing power or storage capacity for the required amounts of data in order to take such deviations into account dynamically using continuously learning models.

Disclosure of the invention

According to the invention, a method for evaluating and adapting prediction models for a network as well as a computing unit and a computer program for its implementation with the features of the independent claims are proposed. Advantageous refinements are the subject matter of the subclaims and the description below.

In particular, a method for adapting a network model is described in which current signal parameter values for at least one signal parameter, which describe signals sent on a network, are initially received in an evaluation unit. There, an adapted model of the electronic architecture of the network is created on the basis of the at least one signal parameter. The adapted model can be compared with a model stored for the network in the evaluation unit, and on the basis of this comparison it can be decided whether the model needs to be updated. Finally, if the model needs to be updated, an appropriately adapted model can be sent back to the network. This enables the detection of possible changes in the fingerprint system and thus also the timely adaptation of the system before a reliable differentiation of the transmission units in the network is no longer possible.

The signal parameter values received in the evaluation unit are previously recorded or determined by a suitable unit and transmitted to the evaluation unit. This is preferably also done within the scope of the invention, but can also be independent of it.

According to one embodiment, the decision as to whether the model needs to be updated can include the prediction of expected parameter values for the at least one signal parameter and a comparison of the expected parameter values with the received signal parameter values.

In this case, signal parameters can be used for the evaluation which are at least partially specific for a network subscriber who has sent the associated signal in the network. Such signals can be used as signal fingerprints to identify transmitters in the network and should be clearly and reliably recognized even in the event of deviations. The evaluation of the models can therefore analyze whether reliable detection is still possible with sufficient certainty with the existing model data.

For this purpose, it is possible, for example, to check the probability that the transmitted signal can be assigned to a specific network participant with the present model.

Various analog and digital parameters that can be obtained from a detected signal, such as a clock offset of a signal, a signal jitter, an edge steepness of a rising or falling signal edge, fluctuations in a signal voltage, a frequency component of a signal, can be used as signal parameters for such methods Signal, a bit length of a signal and others.

The model of the electronic and electrical network architecture can include, for example, a machine learning algorithm, a neural network, a stochastic model, a data-based model. A stored or defined model can then be suitably adapted on the basis of the received signal parameters.

In addition, signal parameters from at least two different networks can be statistically evaluated, the networks having at least partially identical network properties. In this way, for example, more precise predictions can be obtained on the basis of data from several vehicles with the same network architecture and thus possible deviations and concept drift changes can be predicted more reliably.

In addition, such data from several networks, e.g. centrally collected data from many vehicles of one type, can be used to create or adapt the network models on the basis of the network properties and the statistical evaluation of signal parameters.

One possible application of the above embodiments is in a network that includes a controller area network bus, CAN bus, in a vehicle, the evaluation unit including a remote central processing unit. This offers the possibility of evaluating an adapted fingerprint model for the vehicle bus in a suitably equipped backend, creating it and sending it to the vehicle. In this way, the computationally intensive process of model adaptation is outsourced to the so-called backend, which reduces the load on the fingerprint system in the vehicle.

In this way, signal fingerprints can be validated more reliably and accurately, even if the physical properties change due to aging and similar conditions.

A computing unit according to the invention, e.g. an electronic control unit in a motor vehicle, is set up, in particular in terms of programming, to carry out a method according to the invention. Several computing units can be used to carry out the method, a first unit recording or determining signal parameters and optionally evaluating them and transmitting them to a further unit, while a computing unit used as an evaluation unit can be set up to carry out the remaining steps.

The implementation of a method according to the invention in the form of a computer program or computer program product with program code for performing all method steps is advantageous, since this causes particularly low costs, especially if an executing control device is used for other tasks and is therefore available anyway. Suitable data carriers for providing the computer program are, in particular, magnetic, optical and electrical memories, such as hard drives, flash memories, EEPROMs, DVDs, etc. A program can also be downloaded via computer networks (Internet, intranet, etc.).

Further advantages and embodiments of the invention emerge from the description and the accompanying drawing.

The invention is shown schematically in the drawing using exemplary embodiments and is described below with reference to the drawing.

Figure list

• 1 shows an example of a bus system in which embodiments of the invention can be used; and
• 2 shows an exemplary method sequence according to an embodiment of the invention.

Embodiments of the invention

1 Figure 12 shows an exemplary system in which embodiments of the invention may be used. This includes a network 1 that is a bus line 10 has that with terminating resistors 20th , 22nd is provided at their ends. Several participants can be on the bus 30th , 32 , 34 be connected, which are also referred to as nodes, in the case of a vehicle bus, in particular several electronic control units (ECU, electronic control unit) that can control various associated modules such as actuators and sensors in the vehicle and thus the most diverse tasks from braking systems to positioning systems Can support motor control functions.

A large number of participants can be connected to a bus line, often fifty or more elements per bus line in vehicles 10 . Every network participant 30th , 32 , 34 comprises at least one corresponding control unit and a transceiver or transceiver that can send and receive signals on the bus.

A CAN bus system (Controller Area Network) with a corresponding protocol is discussed here as an example, but the method steps used can also be transferred to other networks and protocols.

The bus line 10 includes two signal conductors 12th , 14th , on which a differential binary signal with a non-return-to-zero code is transmitted. According to the CAN bus protocol, all bus users have essentially the same rights, ie they can send messages to the bus at any time, and Collisions are avoided by bit-by-bit arbitration. The bus participants 30th , 32 , 34 are connected to stub lines via their respective transceivers 50 , 52 , 54 with the two signal conductors 12th , 14th (CAN high / CAN low) connected.

One of the participants connected to the bus can 30th , 32 , 34 comprise a hardware- and / or software-based module which is able to record and evaluate physical properties or parameters of the signals sent on the bus system in an analogue and / or digital manner. Such a unit can specifically only be provided for the parameter measurement, or can also take on further control tasks or be connected to other components. In particular, such a module can be set up for an attack detection system based on a signal fingerprint, as described above.

Such physical signal parameters can be recorded regularly or determined from measurement data and transmitted to an evaluation unit, for example to a processing unit in the network, in another area of the vehicle or also to a central processing unit or a system backend 62 that provides the data and models for a wide variety of bus systems 1 can evaluate. For this purpose, a gateway element can be used as a bus participant or network node 34 be provided that a connection to one or more other networks via appropriate interfaces 60 enables. This can be further parallel vehicle buses that are separated according to their functions, for example, or external networks such as a WLAN network or access to the Internet via a cellular connection or other interfaces.

The parameters can optionally also be used there, for example, to keep a model of the bus architecture up-to-date on the electrical / electronic level.

As already described, it is desirable to use a signal fingerprint system to identify network participants or senders of a signal on the bus to recognize when deviations occur due to Concept Drift, and to adapt the model used in good time to ensure reliable recognition of the Allow fingerprints.

In principle, simple detection methods for Concept Drift can be used for this purpose. These monitor the function of the classifier by using standard methods for assessing the accuracy and hit rate. If a threshold value is exceeded, a new model is generated or the old model is suitably adapted. Such procedures are for example in the chapter An Overview of Concept Drift Applications, I Zliobaite, M Pechenizkiy, J Gama in “Big data analysis: new algorithms for a new society”, pp. 91-114 described.

According to one embodiment of the invention, the models of the network can be processed for this purpose in a separate processing unit, preferably in a so-called backend of the system. There, an individual and as concrete as possible mathematical model of the electronic and electrical architecture for each associated network (e.g. each vehicle bus) can be saved and kept up-to-date in a suitable manner. Such models can be generated with the usual methods, as shown in detail in “Simulation of CAN bus physical layer using SPICE”, IEEE International Conference on Applied Electronics, 2013.

The backend can be a computing unit such as a processor with sufficient computing power within the vehicle, which is connected to the bus system via communication channels, or a remote central computing unit such as a computing center or a server. Further components such as volatile and non-volatile memory elements, interfaces for data transmission and the like can be present in a suitable embodiment and are not described in more detail here.

The required data such as the parameters and the model data can be transferred from the network via suitable interfaces, depending on the location of the processing unit, for example via wired interfaces in the vehicle and / or via wireless interfaces that connect directly to the respective backend or to an external network such as the Internet.

The system parameters that reflect the properties of the bus system can be predefined or varied. For example, the backend can request certain parameters, or all measured parameters can always be transmitted. Depending on which computing power is available in or on the bus system, the recorded measurement data for the parameters can be transmitted as raw data or as data that has already been processed.

2 shows an exemplary method sequence according to an embodiment of the invention. First, in step 100 one or more signal parameters of transmitted signals in a network, for example in a vehicle bus, are recorded.

Various analog or digital signals can be used as measured signal parameters Signal properties in question, such as the slope of a rising and / or falling edge, the signal-to-noise ratio of the signal, the bit length of the digital signal, and other quality-relevant properties. In particular, parameters can also be measured that are used as a signal fingerprint and are sufficiently specific for precisely one respective transmitter in the network.

These recorded signal parameters can then be transmitted via an interface and in step 110 in the backend responsible for the evaluation 62 (Computing unit) are received. In the case of a remote backend, a computing unit can be responsible for a large number of networks or vehicles and store, process and evaluate their parameters and / or models. It can be provided here that the vehicle system or, in general, the interface device which transmits the parameters to the backend, is provided with an identifier which unambiguously assigns it to the models stored there 200 enables. The current network models currently used can therefore preferably be stored in the backend for each fingerprint system.

The present model can then be adapted on the basis of the received signal parameters, if this appears necessary. The usual methods for analyzing the deviations (see above) can be used for this, as there is sufficient computing power available in the backend. In this case, threshold values can be defined which determine whether an adaptation of the model in the vehicle bus is currently required or whether the deviations are such that an adaptation should not be carried out at the moment. The threshold values can also be defined depending on the design of the data connection and the fingerprint systems in the bus. Other analysis methods for determining concept drift are also known and can be used here.

In particular, it can be determined which deviations in relation to the monitored fingerprint parameters are to be expected due to the change in the signal parameters. This can be done from the received signal parameters of the network in step 120 a modified architecture model can be created in the backend. You can then use the two models in step 130 can be compared with one another, for example with regard to the distinguishability of the signal fingerprint parameters that result from the respective model.

If the analysis of the models shows that the model currently used in the vehicle bus needs to be adapted or recreated, such an adaptation can be performed in step 140 and then the modified model in step 150 back to the fingerprint system or to another model unit in the network that manages the model of the network architecture locally, where it can then overwrite the model currently in use. If the model is defined using certain specified model parameters, it may be sufficient to transfer only these or only the changed ones back to the fingerprint system, where the received data are then used to create the complete model. If the existing model offers sufficient accuracy, a new measurement and evaluation cycle in step 100 to be started.

It can also be checked whether, for example, a model can be selected from a large number of previously stored modified models, which now enables a better assignment of the fingerprint parameters than the model currently used in the bus system. Information from other vehicles that use the same bus architecture, for example, can also flow in here. Such data can enable changes to be predicted at an early stage.

In particular, parameters from several networks or bus systems can also be used in the described evaluation and adaptation of the model accuracy, in particular, for example, signal parameters that are obtained from several vehicle buses. This data obtained from different sources can be suitably evaluated, e.g. also sorted according to the same or equivalent properties as identical bus systems in a vehicle type or equivalent components on a bus. Various statistical evaluation methods can be used, whereby the data can be suitably stored and also collected, evaluated and combined over specified periods of time, e.g. for the formation of temporal mean values or for the observation of long-term changes. The data obtained in this way can then be used to improve the adaptation of the network models and to evaluate the changed signal parameters more reliably in order to reliably identify long-term changes compared to the model used.

If it has been determined that the model in the vehicle bus has to be changed or updated and the corresponding updated model data has been sent to the fingerprint unit, it is ensured that signal fingerprints of the existing components can still be reliably identified, even if the physical properties change due to aging and change similar conditions. The Use of the model also allows predictions about the expected fingerprints after a long vehicle stop, after which the bus properties may have changed abruptly, which can be accelerated by the weather, for example.

It goes without saying that all of the usual methods and algorithms for recognizing and taking into account concept drift effects can be used. The choice of the suitable method can also depend, among other things, on the type of modeling, the data structure and the learning algorithms that are used.

The above-mentioned method can also be used for all networks in which unique signal properties are used as fingerprints for transmitter identification together with corresponding models.

QUOTES INCLUDED IN THE DESCRIPTION

This list of the documents listed by the applicant was generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Patent literature cited

• DE 102017208547 A1 [0008]

Non-patent literature cited

• An Overview of Concept Drift Applications, I Zliobaite, M Pechenizkiy, J Gama in "Big data analysis: new algorithms for a new society", pp. 91-114 [0038]

Claims (14)

A method for adapting a network model (200) comprising: Receiving (110), in an evaluation unit (62), signal parameter values of at least one signal parameter of a signal sent on a network (1); Creating (120) an adapted model of the electronic architecture of the network (1) on the basis of the at least one signal parameter; Comparing (130) the adapted model with a model (200) stored for the network in the evaluation unit, Based on the comparison, decide whether the model needs to be updated; and if the model needs to be updated, sending (150) an adapted model to a model unit in the network (1). Procedure according to Claim 1 wherein the determining (130) whether the model needs to be updated comprises: predicting expected parameter values for the at least one signal parameter based on the stored model (200), and comparing the expected parameter values with the received signal parameter values. Procedure according to Claim 1 or 2 , wherein at least a part of the received signal parameters is specific to a network subscriber who has sent the associated signal in the network. Procedure according to Claim 3 wherein the decision (130) whether the model needs to be updated comprises: checking a probability that the signal sent on the network can be assigned to a particular network subscriber (30, 32, 34). Method according to one of the preceding claims, wherein the at least one received signal parameter (100) comprises at least one of the following: a clock offset of a signal, a signal jitter, an edge steepness of a rising or falling signal edge, fluctuations in a signal voltage, a frequency component of a signal, a Bit length of a signal. Method according to one of the preceding claims, wherein the model (200) comprises at least one of the following: a machine learning algorithm, a neural network, a stochastic model, a data-based model. A method according to any one of the preceding claims, further comprising: Adapting the stored model (140) based on the received signal parameter values. A method according to any one of the preceding claims, further comprising: statistical evaluation of signal parameters in at least two different networks, the networks having at least partially identical network properties. Procedure according to Claim 8 , further comprising forming or adapting the model (140) for signals in a network on the basis of the network properties and the statistical evaluation of signal parameters from a plurality of networks. A method according to any one of the preceding claims, further comprising: Determining (100) current signal parameter values for at least one signal parameter which describe the signals sent on a network (1); and Sending the at least one signal parameter value to the evaluation unit (62). Method according to one of the preceding claims, wherein the network comprises a controller area network bus (1) in a vehicle and wherein the evaluation unit (62) comprises a computing unit located at a distance from the vehicle. Computing unit which is set up to carry out all method steps of a method according to one of the preceding claims. Computer program that causes a processing unit to perform all process steps of a process according to one of the Claims 1 to 11 to be carried out when it is executed on the processing unit. Machine-readable storage medium with a computer program stored thereon Claim 13 .

Images