KR102469399B1 - Attack detection system of can network, attack detection method of can network and computer program stored in a recording medium to execute the method - Google Patents

Abstract

A disclosed attack detection system of a CAN network controlled through a CAN method according to one embodiment of the present invention comprises a processor configured to determine whether or not an attack is performed in units of CAN packets based on CAN packets of the CAN network. The processor is configured to determine a predetermined number of CAN packets from among the plurality of CAN packets as analysis target packets based on the order of generation of the CAN packets; determine an analysis target time based on a difference between a generation time of the first generated analysis target packet and a generation time of the latest generated analysis target packet; determine one or more analysis target packets including the same data among the analysis target packets as the same data packets; and determine whether or not an attack is performed in units of the CAN packets for the CAN network based on the analysis target time and the number of the same data packets. Accordingly, the present invention can contribute to the detection of hacking attacks.

Description

A computer program stored in a recording medium to execute an attack detection system of a CAN network, a method of detecting an attack of a CAN network, and a method of detecting an attack of a CAN network RECORDING MEDIUM TO EXECUTE THE METHOD}

The present invention relates to a system and method for detecting an attack on a CAN network, and more specifically, an attack detection system capable of detecting whether a specific CAN packet among a plurality of CAN packets is a packet used for an attack on a CAN network. and an attack detection method.

In-vehicle electronic devices may transmit and receive data through an in-vehicle communication network. Recently, various options are applied to vehicles, and accordingly, the complexity of electric parts and communication networks installed in vehicles is increasing.

In general, electronic control units (ECUs) of electronic devices in a vehicle communicate with each other using a controller area network (CAN). That is, the electronic devices of the vehicle perform various functions by exchanging data with each other through the CAN bus.

CAN is vulnerable to packet injection attacks due to the absence of encryption applied to data within data frames and the absence of authentication fields for transmission targets. To counter these attacks, many Intrusion Detection Systems (IDS) are being developed. Intrusion detection systems developed so far are divided into Datalink layer based IDS and Physical layer based IDS.

Physical layer-based IDS is a hardware-based IDS, and the research uses oscilloscope equipment with analog signal input channels, which has limitations in that it is affected by the vehicle's operating environment (e.g. temperature, humidity, etc.) during measurement.

Datalink layer-based IDS is CAN message-based IDS, and in previous studies, it detects intrusion using only the network packet period. This has a problem in that the false positive rate is high because the packet period, which is normal in real vehicles, is not constant.

Therefore, a technique capable of more accurately detecting an attack on a CAN network controlled through a CAN scheme is required.

The present invention analyzes information included in CAN packets of a CAN network, determines whether the state of the corresponding CAN packet is normal, and finds out whether there is an attack on the CAN packet unit, thereby enabling safe vehicle operation. It is to provide an attack detection system and an attack detection method.

In addition, the present invention can detect attack packets of spoofing attack, which is an attack in which a CAN message is generated and injected to perform a function desired by an attacker targeting an arbitration ID performing a specific function in a CAN network. It is to provide an attack detection system and an attack detection method that can contribute.

An attack detection system of a CAN network controlled through a CAN method according to an aspect of the disclosed invention includes a processor configured to determine whether or not an attack is performed in units of CAN packets based on CAN packets of the CAN network, wherein the processor comprises: : Based on the order of generation of the CAN packets, determining a preset number of CAN packets among the plurality of CAN packets as analysis target packets; determining an analysis target time based on a difference between a creation time of the first generated packet to be analyzed and a creation time of the latest generated packet to be analyzed; determining one or more analysis target packets including the same data among the analysis target packets as the same data packet; And based on the analysis target time and the number of the same data packets, it may be configured to determine whether or not an attack is performed in units of CAN packets to the CAN network.

In addition, the processor may be configured to determine a plurality of CAN packets adjacent to each other based on a generation order among the plurality of CAN packets as the predetermined number of analysis target packets.

In addition, the processor: determines a value obtained by dividing the number of identical data packets by the analysis target time as identical data rate information; And based on the same data rate information, it may be configured to determine whether or not an attack is performed in units of the CAN packet.

In addition, the same data rate information of the learning CAN packet determined based on the learning CAN packet is set as an input variable, and the normality information of the learning CAN packet is set as an output variable to generate a machine learning model through a machine learning method. It may further include a machine learning unit; and the processor may be configured to determine whether the CAN packet unit is attacked by the machine learning model based on the same data rate information.

Further, the processor: determines a reference equal data rate based on the machine learning model; And it may be configured to determine whether the CAN packet unit is attacked by comparing the same data rate information and the reference same data rate.

Further, the processor: determines a reference packet from among a plurality of the CAN packets; determining one or more analysis target packets including data identical to data of the reference packet among the analysis target packets as the same data packet; And based on the analysis target time and the number of the same data packets, it may be configured to determine whether the reference packet is an attack packet for the CAN network.

In addition, the processor may be configured to determine a CAN packet within a preset number range of the reference packet as the analysis target packet based on the generation order of the CAN packet.

In addition, the processor, based on the order of generation of the CAN packet, a CAN packet included between a CAN packet generated earlier by a preset number than the reference packet and a CAN packet generated later by the preset number than the reference packet It may be configured to determine as the analysis target packet.

Further, the processor: determines a reference packet from among a plurality of the CAN packets; Based on the order of generation of the CAN packets, determining CAN packets within a preset number range of the reference packets as the analysis target packets; determining one or more analysis target packets including data identical to data of the reference packet among the analysis target packets as the same data packet; determining a value obtained by dividing the number of identical data packets by the analysis target time as identical data rate information; And it may be configured to determine whether the reference packet is an attack packet for the CAN network based on the same data rate information.

An attack detection method for determining whether a CAN packet unit is attacked based on a CAN packet of a CAN network controlled by a processor through a CAN method according to an aspect of the disclosed invention, based on the order in which the CAN packets are generated, a plurality of Determining a preset number of CAN packets among the CAN packets as analysis target packets; determining an analysis target time based on a difference between a generation time of the first analysis target packet and a latest generation time of the analysis target packet; determining one or more analysis target packets including the same data among the analysis target packets as the same data packet; and determining whether or not an attack is performed in units of CAN packets on the CAN network based on the analysis target time and the number of identical data packets.

In addition, determining a reference packet from among the plurality of CAN packets; and determining the predetermined number of CAN packets as analysis target packets, based on the generation order of the CAN packets, the reference packet Determining a CAN packet within a preset number range as the analysis target packet; wherein the determining as the same data packet includes one of the analysis target packets including the same data as the data of the reference packet. Determining the above analysis target packets as the same data packet; and determining a value obtained by dividing the number of identical data packets by the analysis target time as the same data rate information; further comprising, the CAN packet The step of determining whether the unit is attacked may include determining whether the reference packet is an attack packet for the CAN network based on the same data rate information.

A computer program according to an aspect of the disclosed invention is a computer-readable record to execute an attack detection method for determining whether or not an attack is performed in units of CAN packets based on CAN packets of a CAN network controlled by the processor through a CAN method. can be stored on media.

According to one aspect of the disclosed invention, it is possible to analyze information included in CAN packets of a CAN network and determine whether the state of the corresponding CAN packet is normal to find out whether there is an attack on a CAN packet unit, thereby providing a safe vehicle. driving can be made possible.

In addition, according to an embodiment of the present invention, it is possible to detect attack packets of spoofing attack, an attack in which a CAN message is generated and injected to perform a function desired by an attacker targeting an arbitration ID performing a specific function in a CAN network. It can contribute to the detection of hacking attacks.

1 is a configuration diagram of an attack detection system according to an embodiment.
2 is a diagram for explaining an attack detection algorithm according to an embodiment.
3 is a diagram illustrating a CAN packet according to an embodiment.
4 is a diagram illustrating a packet to be analyzed according to an embodiment.
5 is a diagram for explaining determining equal data rate information according to an exemplary embodiment.
6 is a diagram illustrating arranging the same data rate information for each reference packet according to an embodiment.
7 is a flowchart of an attack detection method according to an embodiment.
8 is a graph showing the same data rate information in a normal state and a graph showing the same data rate information in an attack state according to an embodiment.
9 is a graph showing the same data rate information for each packet of various CAN IDs according to an embodiment.

Like reference numbers designate like elements throughout the specification. This specification does not describe all elements of the embodiments, and general content or overlapping content between the embodiments in the technical field to which the disclosed invention belongs is omitted. The term '~unit' used in the specification may be implemented in software or hardware, and according to embodiments, a plurality of '~units' may be implemented as one component, or one '~unit' may constitute a plurality of components. It is also possible to include elements.

In addition, when a certain component is said to "include", this means that it may further include other components without excluding other components unless otherwise stated.

'~ unit' used in this specification is a unit that processes at least one function or operation, and may mean, for example, software, an FPGA, or a hardware component. Functions provided by '~unit' may be performed separately by a plurality of components or may be integrated with other additional components. '~unit' in this specification is not necessarily limited to software or hardware, and may be configured to be in an addressable storage medium or configured to reproduce one or more processors.

Expressions in the singular number include plural expressions unless the context clearly dictates otherwise.

In each step, the identification code is used for convenience of description, and the identification code does not explain the order of each step, and each step may be performed in a different order from the specified order unless a specific order is clearly described in context. have.

Hereinafter, the working principle and embodiments of the disclosed invention will be described with reference to the accompanying drawings.

1 is a configuration diagram of an attack detection system according to an embodiment.

Referring to FIG. 1 , an attack detection system 100 of a CAN network controlled through a controller area network (CAN) method according to an embodiment of the present invention includes a processor 110, a machine learning unit 120, and a memory 130. can include

CAN is a vehicle network for electronically controlling various devices such as doors, windows, lights, accelerators, brakes, etc., and is also used in autonomous vehicles and connected cars.

CAN typically has a structure in which electronic control units (ECUs) for controlling each device of a vehicle are connected through a CAN bus. In general, a user command is input to the CAN bus through an input unit provided in a vehicle by user manipulation and transmitted as CAN data.

The processor 110 may obtain the CAN packet 200 of the vehicle CAN network. At this time, the processor 110 may obtain a plurality of CAN packets (200).

The processor 110 may determine whether or not an attack is performed in units of CAN packets based on the obtained CAN packets 200 .

The machine learning unit 120 may generate the machine learning model 131 through a machine learning method based on the CAN packet 400 for learning. Meanwhile, the machine learning model 131 may be stored in the memory 130 .

The processor 110 may determine whether there is an attack in units of CAN packets based on the machine learning model 131 .

The processor 110 may be provided inside the vehicle for rapid detection of an attack on the vehicle's CAN network. Specifically, the processor 110 may be one ECU, may be installed inside a gateway in a vehicle network controlled through a CAN method, or may be connected to a bus as an independent entity to communicate with the gateway.

As described above, the processor 110 and the memory 130 may be provided in the vehicle, but the processor 110 and the memory 130 do not necessarily have to be provided in the vehicle, and the CAN network of the vehicle controlled through the CAN method. It does not matter how the processor 110 and the memory 130 are implemented, as long as an attack on the can be detected.

For example, the processor 110 and the memory 130 are provided in the server, and the CAN network of the vehicle is configured based on the machine learning model 131 stored in the memory 130 and the CAN packet 200 received from the communication unit of the vehicle. attacks can be detected.

The machine learning unit 120 may include any one processor among a plurality of processors included in the attack detection system 100 . In addition, the attack detection method according to the embodiments of the present invention described so far and the embodiments to be described in the future may be implemented in the form of a program that can be driven by the processor 110 .

Here, the program may include program commands, data files, and data structures alone or in combination. The program may be designed and manufactured using machine language codes or high-level language codes. The program may be specially designed to implement the above-described code correction method, or may be implemented using various functions or definitions that are known and usable to those skilled in the art in the field of computer software. A program for implementing the above information display method may be recorded on a recording medium readable by the processor 110 . At this time, the recording medium may be the memory 130 .

The memory 130 may store a program for performing the above-described operation and an operation to be described later, and the memory 130 may execute the stored program. When the processor 110 and the memory 130 are plural, they may be integrated on a single chip or may be provided in physically separate locations. The memory 130 may include volatile memory such as static random access memory (S-RAM) and dynamic random access memory (D-lab) for temporarily storing data. In addition, the memory 130 may include a read only memory (ROM), an erasable programmable read only memory (EPROM), and an electrically erasable programmable read only memory (EEPROM) for long-term storage of control programs and control data. It may contain non-volatile memory.

The processor 110 may include various logic circuits and arithmetic circuits, process data according to programs provided from the memory 130, and generate control signals according to processing results.

2 is a diagram for explaining an attack detection algorithm according to an embodiment.

Referring to FIG. 2, a method of determining whether a given CAN packet 200 is an attack packet for a CAN network is a method of extracting features of a given CAN packet 200, a machine learning model 131 as a machine learning method It may include a step of learning, a step of reflecting other rules, and a step of determining whether a given CAN packet 200 is an attack packet according to the machine learning model 131 and other rules.

The attack detection method for the CAN network of the present invention mainly relates to the step of extracting the characteristics of the CAN packet (200).

Specifically, the attack detection method of the present invention uses Timestamp (time when the corresponding CAN message is generated), DLC (number of bytes of Data Field), Arbitration_ID (CAN ID), and Data Field of the CAN packet 200 generated in the vehicle. By calculating the density of the CAN packets 200 having the same data and comparing the normal traffic density and the attack traffic density, it is possible to determine whether or not an attack occurs.

In particular, the attack detection method of the present invention can accurately detect the occurrence of a spoofing attack, which is an attack in which a CAN message is generated and injected to perform a desired function by an attacker targeting an arbitration ID performing a specific function.

3 is a diagram illustrating a CAN packet according to an embodiment.

Referring to FIG. 3 , each CAN packet 200 may include a unique creation time value 201 indicating the time it was created.

In addition, since the generation time value 201 of each CAN packet 200 may be different, the plurality of CAN packets 200 may be listed in the order in which they are generated.

A packet of each CAN may be configured in a form including 'CAN ID' and 'command'. The ECU that controls the target device for which the corresponding command is intended can receive the command by identifying the CAN ID 202 in the CAN data being broadcast over the CAN bus and thereby control the target device. A vehicle network controlled through the CAN method may transmit CAN data 203 in the form of a packet called a frame.

4 is a diagram illustrating a packet to be analyzed according to an embodiment.

Referring to FIG. 4 , the processor 110 may determine a predetermined number of CAN packets 200 among a plurality of CAN packets 200 as the analysis target packet 210 based on the order of generation of the CAN packets 200. have.

The packet to be analyzed 210 may be a plurality of CAN packets 200 including the CAN packet 200 to be inspected in order to determine which CAN packet 200 to be inspected is an attack packet for the CAN network.

The processor 110 may determine a plurality of CAN packets 200 adjacent to each other based on the generation order among the plurality of CAN packets 200 as the preset number of analysis target packets 210 .

For example, the analysis target packets 210 shown in FIG. 4 may be all CAN packets 200 generated between 9.580 (ms) and 35.260 (ms).

The processor 110 may determine the analysis target time based on the difference between the generation time of the first analysis target packet 210 and the latest generation of the analysis target packet 210 .

For example, in the processor 110, the generation time of the first CAN packet 200 among the analysis target packets 210 is 9.580 (ms), and the generation time of the latest CAN packet 200 is 35.260 (ms). ms), the analysis target time can be determined as 25.680 (ms), which is the difference between the two generation time values 201.

The processor 110 may determine one or more analysis target packets 210 including the same data among the analysis target packets 210 as the same data packet 211 .

For example, the processor 110 may determine a CAN packet 200 whose CAN data 203 is '1C 04 B6 C0 00 16 38 80' among the packets to be analyzed 210 as the same data packet 211 .

The processor 110 may determine whether the CAN network is attacked in units of CAN packets based on the time to be analyzed and the number of identical data packets 211 .

For example, when using the analysis target packet 210 shown in FIG. 4, the processor 110 analyzes the CAN packet unit based on the analysis target time of 25.680 (ms) and the same number of data packets 211 as 8. attack can be determined.

The processor 110 may determine a value obtained by dividing the number of equal data packets 211 by the time to be analyzed as equal data rate information (EDR) 300 .

For example, if the number of identical data packets 211 is 8 and the analysis target time is 25.680 (ms), 8/25.680 = 0.311, so 0.311 can be determined as the identical data rate information 300.

If there is an attack that repeatedly injects CAN packets 200 having specific data into a CAN network, it may seem that many CAN packets 200 having the same data are generated in a short time.

Accordingly, the processor 110 may determine whether or not an attack is performed in units of CAN packets based on the same data rate information 300 .

For example, the processor 110 may compare the same data rate information 300 and the reference same data rate to determine whether there is an attack in units of CAN packets.

The reference same data rate is whether the calculated same data rate information 300 is the value of the same data rate information 300 of the normal CAN packet 200, or the same data rate information 300 of the CAN packet 200 used in the attack. It may be a value that serves as a criterion for determining whether it is a value of .

For example, if the value of the same data rate information 300 is greater than or equal to the reference same data rate, the processor 110 may determine that there is an attack in units of CAN packets with respect to the analyzed CAN packet 200 .

Meanwhile, the reference same data ratio may be determined through machine learning.

The machine learning unit 120 may acquire the CAN packet 400 for learning.

The machine learning unit 120 uses the same data rate information 300 of the learning CAN packet 400 determined based on the learning CAN packet 400 as an input variable, and the normality information of the learning CAN packet 400 as an output variable. By setting to , the machine learning model 131 can be generated through the machine learning method.

The method of determining the same data rate information 300 of the CAN packet 400 for learning based on the CAN packet 400 for learning is the same as the method of determining the same data rate information 300 based on the general CAN packet 200 can do.

The machine learning model 131 may be a model in which information extracted from the CAN packet 400 for learning is used as an input variable and information on whether the CAN packet 400 for learning is normal is set as an output variable.

The machine learning model 131 may be stored in the memory 130, and the processor 110 converts data of the machine learning model 131 stored in the memory 130 and information included in the CAN packet 200 actually obtained. It is possible to detect whether or not a CAN attack on the CAN packet 200 obtained by using.

The processor 110 may determine whether there is an attack in units of CAN packets by the machine learning model 131 based on the same data rate information 300 .

Specifically, the processor 110 may determine the reference equal data rate based on the machine learning model 131 .

The processor 110 compares the same data rate information 300 determined based on the obtained CAN packet 200 and the reference same data rate determined based on the machine learning model 131 to determine whether there is an attack in units of CAN packets. can judge

For example, if the reference same data ratio determined based on the machine learning model 131 is 0.2, in the case of FIG. 4 , the value of the same data ratio information 300 is 0.311. At this time, since the value of the same data rate information 300 is greater than the reference data rate, the processor 110 may determine that there is an attack in units of CAN packets.

Machine learning may mean using a model composed of multiple parameters and optimizing the parameters with given data. Machine learning may include supervised learning, unsupervised learning, and reinforcement learning depending on the form of a learning problem. Supervised learning is to learn the mapping between inputs and outputs, and can be applied when input and output pairs are given as data. Unsupervised learning is applied when there are only inputs and no outputs, and regularities between inputs can be found.

The machine learning unit 120 according to an embodiment of the present invention learns the information of each learning CAN packet 400 and the normality information of each learning CAN packet 400 based on a random forest to perform machine learning. A model 131 may be created. That is, the machine learning model 131 of the present invention may include a random forest model.

Specifically, the machine learning unit 120 sets the same data rate information 300 of the learning CAN packet 400 as an input variable, and sets the normality information of each learning CAN packet 400 as an output variable to model a random forest. can create

The processor 110 may detect an attack on the vehicle network through a deep learning method as well as a machine learning method, and may detect an attack on the CAN network in various ways.

5 is a diagram for explaining determining equal data rate information according to an exemplary embodiment.

Referring to FIG. 5 , the processor 110 may determine a reference packet 212 from among a plurality of CAN packets 200 .

The attack detection system 100 of the CAN network may determine whether there is a CAN attack for all of the plurality of CAN packets 200 received, but a specific CAN packet 200 among the received CAN packets 200 It may also be determined whether the packet is used for an attack.

The processor 110 may determine, as the reference packet 212 , a CAN packet 200 to be checked whether it is a packet used in an attack from among a plurality of CAN packets 200 .

The processor 110 may determine one or more analysis target packets 210 including the same data as the data of the reference packet 212 among the analysis target packets 210 as the same data packet 211 .

For example, referring to (a) of FIG. 5, when the CAN packet 200 generated at 64.59012 (ms) is determined to be the reference packet 212, the data of the reference packet 212 among the analysis target packets 210 CAN packets 200 including CAN data 203 of '00 01 19 02 01 00 80 00' may be determined as the same data packet 211.

In this case, if all of the CAN data 203 of the analysis target packets 210 are the same, all of the analysis target packets 210 may be determined as the same data packet 211 . In addition, if all of the CAN data 203 of the analysis target packet 210 other than the reference packet 212 are different from the CAN data 203 of the reference packet 212, only one reference packet 212 is the same data packet 211 ) may be determined.

In the case of FIG. 5 (a), all of the CAN data 203 of the analysis target packets 210 are the same, and thus all of the analysis target packets 210 are determined to be the same data packet 211.

The processor 110 may determine whether the reference packet 212 is an attack packet for the CAN network based on the analysis target time and the number of identical data packets 211 .

The processor 110 may determine CAN packets 200 within a preset number range of the reference packet 212 as the analysis target packet 210 based on the generation order of the CAN packets 200 .

For example, the processor 110 converts five CAN packets 200 adjacent to the reference packet 212, including the reference packet 212, into the target packet 210 based on the generation order of the CAN packet 200. can be determined by

The processor 110, based on the order of generation of the CAN packets 200, the CAN packets 200 generated earlier by a preset number than the reference packet 212 and the CAN packets 200 generated later by a preset number than the reference packet 212 The CAN packet 200 included between the CAN packets 200 may be determined as the analysis target packet 210 .

For example, if the preset number is 2, the processor 110 generates two CAN packets 200 and the reference packet 212 generated immediately before the reference packet 212 based on the order of generation of the CAN packet 200. Two CAN packets 200 generated immediately after may be determined as analysis target packets 210 .

In addition, in the embodiment of FIG. 4, since the preset number is 5, based on the order of generation of the CAN packets 200, five CAN packets 200 generated immediately before the reference packet 212 and immediately after the reference packet 212 The generated five CAN packets 200 may be determined as analysis target packets 210 .

The processor 110 may determine whether the reference packet 212 is an attack packet for the CAN network based on the same data rate information 300 .

Specifically, the processor 110 may determine whether the reference packet 212 is an attack packet by comparing the same data rate information 300 and the reference same data rate.

The processor 110 may determine that the corresponding standard packet 212 is an attack packet when the value of the same data rate information 300 corresponding to a specific standard packet 212 is greater than or equal to the standard same data rate.

For example, referring to the embodiment of (a) of FIG. 5, the processor 110 determines the CAN packet 200 having a generation time of 64.59012 (ms) as the reference packet 212, and the reference packet 212 is immediately Two CAN packets 200 generated before and two CAN packets 200 generated immediately after the reference packet 212 may be determined as the target packet 210 for analysis.

In addition, the processor 110 converts five CAN packets 200 of which the CAN data 203 is the same as the data of the reference packet 212 from among the packets to be analyzed 210 to '00 01 19 02 01 00 80 00' as the same data. packet 211.

At this time, the processor 110 has a generation time of the first CAN packet 200 generated among the analysis target packets 210 is 64.19009 (ms), and a generation time of the latest CAN packet 200 is 64.99019 (ms) , 6.249 can be determined as the same data rate information 300 according to the illustrated equation. If the reference equal data rate is 10, the equal data rate information 300 of the reference packet 212 of FIG. It can be judged that this is not the case.

If referring to the embodiment of FIG. 5 (b), the processor 110 determines the CAN packet 200 whose generation time is 67.99299 (ms) as the reference packet 212 and generates it immediately before the reference packet 212. The two CAN packets 200 and the two CAN packets 200 generated immediately after the reference packet 212 may be determined as the target packet 210 for analysis.

In addition, the processor 110 converts four CAN packets 200 of which the CAN data 203 is the same as the data of the reference packet 212, '00 00 00 02 01 00 80 00' among the packets to be analyzed 210 to the same data. packet 211.

At this time, the processor 110 has a generation time of the first CAN packet 200 generated among the analysis target packets 210 is 67.93011 (ms), and a generation time of the latest CAN packet 200 is 68.11188 (ms) , 22.005 may be determined as the same data rate information 300 according to the illustrated equation. If the reference equal data rate is 10, the equal data rate information 300 of the reference packet 212 of FIG. can be judged to be

6 is a diagram illustrating arranging the same data rate information for each reference packet according to an embodiment.

Referring to FIG. 6 , the processor 110 may organize the same data rate information 300 of each of the CAN packets 200 having a specific CAN ID 202 .

For example, the processor 110 collects only CAN packets 200 having a CAN ID 202 of 553, determines a reference packet 212 from among them, and obtains the same data rate information 300 for the reference packet 212. can be determined.

At this time, the processor 110 sequentially determines the CAN packets 200 having the CAN ID 202 of 553 as the reference packet 212 once, and the CAN ID 202 is the same for each of the CAN packets 200 of 553. A value of the data rate information 300 may be determined, and the same data rate information 300 of the CAN packet 200 of the specific CAN ID 202 may be arranged.

At least one component may be added or deleted corresponding to the performance of the components described above. In addition, it will be easily understood by those skilled in the art that the mutual positions of the components can be changed corresponding to the performance or structure of the system.

7 is a flowchart of a method for detecting an attack in a CAN network according to an embodiment. This is only a preferred embodiment for achieving the object of the present invention, and it goes without saying that some components may be added or deleted as needed.

Referring to FIG. 7 , the processor 110 may determine a reference packet 212 from among CAN packets 200 of a CAN network controlled through a CAN scheme (1001).

The processor 110 may determine a predetermined number of CAN packets 200 among the plurality of CAN packets 200 as the analysis target packet 210 based on the order of generation of the CAN packets 200 (1002). At this time, the processor 110 may determine the CAN packets 200 within a preset number range of the reference packet 212 as the analysis target packet 210 based on the generation order.

The processor 110 may determine the analysis target time based on the difference between the creation time of the first analysis target packet 210 and the latest generation analysis target packet 210 (1003).

The processor 110 may determine one or more analysis target packets 210 including the same data among the analysis target packets 210 as the same data packet 211 (1004). In this case, the processor 110 may determine one or more analysis target packets 210 including the same data as the data of the reference packet 212 among the analysis target packets 210 as the same data packet 211 .

The processor 110 may determine a value obtained by dividing the number of identical data packets 211 by the time to be analyzed as the same data rate information 300 (1005).

The processor 110 may determine whether the reference packet 212 is an attack packet for the CAN network based on the same data rate information 300 (1006). At this time, the processor 110 may compare the same data rate information 300 of the reference packet 212 and the reference same data rate to determine whether the reference packet 212 is an attack packet for the CAN network.

In order to verify the performance of the CAN network attack detection method according to an embodiment of the present invention, a CAN packet attack detection experiment was conducted.

8 is a graph showing the same data rate information 300 in a normal state and a graph showing the same data rate information 300 in an attack state according to an embodiment, and FIG. 9 is a graph showing various CAN IDs 202 according to an embodiment. ) is a graph showing the same data rate information 300 for each packet.

Referring to FIG. 8 , an analysis result graph of an attack detection experiment for a CAN packet 200 having a specific CAN ID 202 can be confirmed.

If there is no packet-based attack on the CAN packet 200 whose CAN ID 202 is 0x553, the same data rate information 300 of the CAN packet 200 whose CAN ID 202 is 0x553 generated at any generation time It was confirmed that the value of is kept constant.

On the other hand, if there is a packet-based attack on the CAN packet 200 whose CAN ID 202 is 0x553, the same data rate information ( 300) is greatly increased in size compared to the value of the same data rate information 300 at the non-attacked creation time, and it was confirmed that the value is also not constant for each creation time.

Referring to FIG. 9, regardless of what the CAN ID 202 of the CAN packet 200 is, if there is a packet-based attack on the CAN packet 200 of a specific CAN ID 202, the same data rate information 300 ) is larger in size than the value of the same data rate information 300 at the time of creation without an attack, and it was confirmed that the value is also not constant for each creation time.

As above, the disclosed embodiments have been described with reference to the accompanying drawings. Those skilled in the art to which the present invention pertains will understand that the present invention can be implemented in a form different from the disclosed embodiments without changing the technical spirit or essential features of the present invention. The disclosed embodiments are illustrative and should not be construed as limiting.

100: attack detection system
110: processor
120: machine learning unit
130: memory
131: machine learning model
200: CAN packet
201: creation time value
202 CAN ID
203: CAN data
210: packet to be analyzed
211: identical data packet
212 reference packet
300: equal data rate information
400: CAN packet for learning

Claims (12)

In the attack detection system of the CAN network controlled through the CAN method,
A processor configured to determine whether or not an attack is performed in units of CAN packets based on CAN packets of the CAN network;
The processor:
Based on the order of generation of the CAN packets, determining a preset number of CAN packets from among the plurality of CAN packets as analysis target packets;
determining an analysis target time based on a difference between a creation time of the first generated packet to be analyzed and a creation time of the latest generated packet to be analyzed;
determining one or more to-be-analyzed packets including the same data as the same data packet, based on whether CAN data included in the to-be-analyzed packets is the same;
Based on the analysis target time and the number of identical data packets, determining whether or not an attack is performed in units of CAN packets on the CAN network;
determining a value obtained by dividing the number of identical data packets by the analysis target time as identical data rate information; and
An attack detection system of a CAN network configured to determine whether the CAN packet unit is attacked based on the same data rate information. According to claim 1,
the processor,
An attack detection system of a CAN network configured to determine a plurality of CAN packets adjacent to each other based on a generation order among a plurality of the CAN packets as the preset number of analysis target packets. delete According to claim 1,
Machine learning configured to generate a machine learning model through a machine learning method by setting the same data rate information of the learning CAN packet determined based on the learning CAN packet as an input variable and setting the normality information of the learning CAN packet as an output variable It further includes;
the processor,
An attack detection system of a CAN network configured to determine whether or not an attack is performed in units of the CAN packet by the machine learning model based on the same data rate information. According to claim 4,
The processor:
determine a reference equal data rate based on the machine learning model; and
An attack detection system of a CAN network configured to compare the same data rate information and the reference same data rate to determine whether the CAN packet unit is attacked. According to claim 1,
The processor:
determine a reference packet from among a plurality of the CAN packets;
determining one or more analysis target packets including data identical to data of the reference packet among the analysis target packets as the same data packet; and
An attack detection system of a CAN network configured to determine whether the reference packet is an attack packet for the CAN network based on the analysis target time and the number of identical data packets. According to claim 6,
the processor,
Based on the order of generation of the CAN packets, the CAN network attack detection system configured to determine a CAN packet within a preset number range of the reference packet as the analysis target packet. According to claim 7,
the processor,
Based on the order of generation of the CAN packets, a CAN packet included between a CAN packet generated earlier by a preset number than the reference packet and a CAN packet generated later by the preset number than the reference packet is regarded as the analysis target packet. An attack detection system in a CAN network configured to determine According to claim 1,
The processor:
determine a reference packet from among a plurality of the CAN packets;
Based on the order of generation of the CAN packets, determining CAN packets within a preset number range of the reference packets as the analysis target packets;
determining one or more analysis target packets including data identical to data of the reference packet among the analysis target packets as the same data packet;
determining a value obtained by dividing the number of identical data packets by the analysis target time as identical data rate information; and
An attack detection system of a CAN network configured to determine whether the reference packet is an attack packet for the CAN network based on the same data rate information. An attack detection method for determining whether a CAN packet unit is attacked based on a CAN packet of a CAN network controlled by a processor through a CAN method,
Based on the order of generation of the CAN packets, determining a preset number of CAN packets from among the plurality of CAN packets as analysis target packets;
determining an analysis target time based on a difference between a generation time of the first analysis target packet and a latest generation time of the analysis target packet;
determining one or more analysis target packets including the same data as the same data packet, based on whether CAN data included in the analysis target packets is the same;
determining whether or not the CAN network is attacked in units of CAN packets based on the analysis target time and the number of identical data packets; and
Determining a value obtained by dividing the number of identical data packets by the analysis target time as the same data rate information;
The step of determining whether the CAN packet unit is attacked is
A method for detecting an attack in a CAN network comprising: determining whether or not an attack occurs in units of the CAN packet based on the same data rate information. According to claim 10,
Further comprising: determining a reference packet from among the plurality of CAN packets;
The step of determining the preset number of CAN packets as analysis target packets,
Based on the order of generation of the CAN packets, determining a CAN packet within a preset number range of the reference packet as the analysis target packet; Including,
The step of determining the same data packet,
Determining one or more analysis target packets including data identical to data of the reference packet among the analysis target packets as the same data packet;
The step of determining whether the CAN packet unit is attacked is
and determining whether the reference packet is an attack packet for the CAN network based on the same data rate information. A computer program stored in a computer-readable recording medium to execute the CAN network attack detection method according to any one of claims 10 to 11.

Images