KR20150131669A - Detecting method for malicious intrusion through network by monitoring signal of electronic apparatus and vehicle for detecting malicious intrusion through network by analysing signal of ecu - Google Patents

Abstract

A method for sensing a network attack by monitoring an electronic device signal includes the steps of: enabling a target device, which includes at least one electronic device and transmits and receives information to and from an external network device through a communications module, to obtain a signal of the electronic device; enabling the target device to extract the feature point from the signal; and enabling the target device to determine whether the signal is abnormal by comparing the feature point with a standard feature point which is previously prepared.

Description

TECHNICAL FIELD [0001] The present invention relates to a method of detecting a network attack by monitoring an electronic device signal and a method of detecting a network attack by analyzing an ECU signal, ECU}

The following description relates to a method for detecting a network attack based on a signal of an electronic device included in a device connected to an external network.

A network device or a device connected to the network may be subjected to malicious attack via the network or may be hacked. Therefore, researches on technologies to detect attacks or hacking among network related technologies or technologies to detect them are being actively conducted.

Most network attack detection techniques analyze data packets to detect network attacks. On the other hand, communication with outside is carried out like smart car, but security issue is also highlighted for basically isolated system.

Korea Patent Publication No. 2012-0037865 Korean Patent Publication No. 2003-0055745

A technique to be described below is to provide a method for determining whether an abnormal state such as an external attack is detected by analyzing a signal in a device for exchanging signals between internal electronic devices.

The solutions to the technical problems described below are not limited to those mentioned above, and other solutions not mentioned can be clearly understood by those skilled in the art from the following description.

A method of monitoring an electronic device signal to detect a network attack includes at least one electronic device, the target device receiving information from and communicating with an external network device via a communication module acquiring a signal of the electronic device, Extracting feature points from the feature points, and comparing the feature points with standard feature points provided in advance to determine whether the signals are in an abnormal state.

The electronic device may be at least one of a communication device, an audio device, a video device, or a sensor device.

A method for monitoring an electronic device signal to detect a network attack includes acquiring a standard signal of an electronic device in which the target device has previously occurred in at least one of a steady state or an abnormal state, Extracting standard feature points and storing them in a memory device.

Determining whether the target device is in an abnormal state of the electronic device, determining that the signal is in an abnormal state if the standard feature point distribution and the distribution of the feature points coincide with a reference value or more, If the distribution of the minutiae points do not coincide with the reference value or more, the signal can be judged to be in an abnormal state.

A vehicle that analyzes ECU signals to detect a network attack is a communication device that exchanges data with an external network device, an electronic device that transmits a generated signal through an internal communication module using a communication protocol, The method comprising: extracting feature points from a memory device that stores standard feature points of standard signals generated by an electronic device in at least one of states and states generated by an electronic device, and comparing the extracted feature points with standard feature points to determine whether they are in an abnormal state And an ECU device.

The electronic device analyzes an ECU signal that is at least one of a steering device, a braking device, a lighting device, a power generating device, a power transmitting device, a power control device, an audio device, a video device, a dashboard device or a navigation device.

The technique described below can detect an abnormal state of an electronic device by analyzing a signal itself in an apparatus in which an electronic apparatus communicates signals through internal communication, such as an automobile. The technique described below analyzes the control signal generated in the electronic device inside the device without analyzing the data packet received from the outside, and detects the abnormal state of the electronic device. Therefore, An abnormal state can be detected.

The effects of the techniques described below are not limited to those mentioned above, and other effects not mentioned can be clearly understood by those skilled in the art from the following description.

Figure 1 is an example of a flowchart for a method of monitoring an electronic device signal to detect a network attack.
FIG. 2 is an example of a flowchart for extracting and analyzing minutiae.
3 is an example of a feature point distribution.
4 is an example of a block diagram showing the configuration of a vehicle that analyzes a network signal by analyzing an ECU signal.

The following description is intended to illustrate and describe specific embodiments in the drawings, since various changes may be made and the embodiments may have various embodiments. However, it should be understood that the following description does not limit the specific embodiments, but includes all changes, equivalents, and alternatives falling within the spirit and scope of the following description.

The terms first, second, A, B, etc., may be used to describe various components, but the components are not limited by the terms, but may be used to distinguish one component from another . For example, without departing from the scope of the following description, the first component may be referred to as a second component, and similarly, the second component may also be referred to as a first component. And / or < / RTI > includes any combination of a plurality of related listed items or any of a plurality of related listed items.

As used herein, the singular " include "should be understood to include a plurality of representations unless the context clearly dictates otherwise, and the terms" comprises & , Parts or combinations thereof, and does not preclude the presence or addition of one or more other features, integers, steps, components, components, or combinations thereof.

Before describing the drawings in detail, it is to be clarified that the division of constituent parts in this specification is merely a division by main functions of each constituent part. That is, two or more constituent parts to be described below may be combined into one constituent part, or one constituent part may be divided into two or more functions according to functions that are more subdivided. In addition, each of the constituent units described below may additionally perform some or all of the functions of other constituent units in addition to the main functions of the constituent units themselves, and that some of the main functions, And may be carried out in a dedicated manner. Accordingly, the presence or absence of each of the components described herein will be interpreted as a function. For this reason, a method (100) for detecting a network attack by monitoring an electronic device signal described below and an ECU signal, It is clear that the configuration of the components according to the automobile 500 that senses the vehicle can be different from the corresponding figures in so far as the object of the technique described below can be achieved.

Also, in performing a method or an operation method, each of the processes constituting the method may take place differently from the stated order unless clearly specified in the context. That is, each process may occur in the same order as described, may be performed substantially concurrently, or may be performed in the opposite order.

The technique described below analyzes the signal itself generated and transmitted by the electronic device in the target device including at least one electronic device to determine whether the electronic device or the target device is in a normal state. The target device basically means a finished product composed of at least one electronic device. The target device does not have to be an independent transaction object, but the target device itself may be a part of an independent transaction object. The electronic device is a device corresponding to a component constituting the target device.

The technique described below is for determining whether or not an electronic device included in the target device or the target device is in an abnormal state. It may be a signal received from the outside through a communication device included in the target device, It is judged whether or not there is a malfunction due to the data. Therefore, the target device basically corresponds to a device that receives certain data or signals through the external network through the communication device. However, the technique described below does not necessarily have to receive data or signals through an external network, and the present invention also applies to receiving data or signals directly through the interface device of the target device.

For example, the target device may be an automobile, and the electronic device may be a braking device, a steering device, a power transmission device, etc. contained in the automobile. Almost all automobiles currently produced use automotive communications, such as CAN, to send and receive signals between electronic devices. Recently, researches on communication systems connected to automobiles such as VANET are being conducted. Furthermore, a field called smart car is being studied. That is, the automobile can receive certain information or control commands through the external network. Therefore, there is a possibility that a third party sends a malicious attack signal to control the vehicle or cause malfunction of the vehicle. Or a denial of service (DOS) attack on a smart car that is automatically run by a third party may result in a major accident. In the field of smart cars, security issues are also highlighted.

Of course, the techniques described below are not applicable to automobiles, and can be applied to various target devices that internally exchange signals or data packets between the electronic devices as described above.

Hereinafter, a method 100 for detecting a network attack by monitoring an electronic device signal with reference to the drawings and a vehicle 500 for detecting a network attack by analyzing an ECU signal will be described in detail.

1 is an example of a flowchart for a method 100 for monitoring an electronic device signal to detect a network attack.

The target device uses the characteristic point for the signal or data packet generated by the electronic device to determine the abnormal state of the internal electronic device. A feature point is extracted with respect to a signal transmitted from an electronic device to a control device (central processing unit) that controls the electronic device. Meanwhile, when a data packet is transmitted, not only the contents of the data packet itself are analyzed, but the data packet also corresponds to a kind of electronic signal. Therefore, the characteristic of the electronic signal itself is analyzed by the electronic signal. For example, an electronic signal can be analyzed in a form having a constant frequency and intensity over time. Further, various methods for analyzing electronic signals can be used. Of course, the electronic device may analyze the transmitted data packet itself to determine whether it is in an abnormal state.

In order to determine whether the signal to be transmitted by the target device is abnormality, a sample that can compare the abnormality state is required. Or a sample that deviates greatly from a distribution of samples obtained from a steady state at a certain threshold value as an abnormal sample. Accordingly, a method 100 for monitoring an electronic device signal to detect a network attack must first provide a standard feature point (110). Standard feature points are feature points that are extracted from signals generated by at least one electronic device included in the target device in a steady state or an abnormal state. Standard feature points can be pre-generated in the form of a classifier by learning signals generated by an electronic device in a steady state or an abnormal state.

Thereafter, the target device receives certain data from the external network device through the communication device or the communication module (120). This process is basically necessary because it is assumed that an abnormal state of the electronic device occurs due to an external signal. A signal may be input through an interface device other than the network.

The target device then acquires the signal of the operating electronic device (130) and extracts feature points from the acquired signal (140). The target device compares the extracted feature points with standard feature points to determine whether the signal generated by the electronic device is in an abnormal state (150). That is, whether the electronic device has generated an unintended abnormal signal by an external signal.

The process of extracting feature points from the signal to be anomaly and extracting standard feature points are in fact the same. However, it is preferable that the process of extracting standard feature points is performed on a plurality of signals in order to provide a more accurate comparison value without performing a signal generated once in a normal state or an abnormal state. That is, a feature point is extracted from a plurality of signals generated in a predetermined state to prepare a learned sample.

Figure 2 is an example of a flowchart for a process 200 for extracting and analyzing minutiae. A method 200 for extracting and analyzing minutiae points comprises a step 210 of receiving a signal transmitted by an electronic device, a step 220 of removing noise from the acquired signal, a technique of extracting minutiae points of data from the noise- A step 230 of generating feature points in the form of a base function, a step 240 of reducing the dimension of the feature points if necessary, and a step 250 of analyzing the feature points using the learned classifiers (standard feature points) do.

The signal generated by the electronic device may be a data packet, a digital signal, or an analog signal that is transmitted over a communication protocol.

If the electronic device is a device for collecting peripheral data or a sensor device for collecting control instructions of a user, the obtained signal may be distorted due to exposure to noise due to ambient noise or mechanical vibration. Thus, a preprocessing process 220 for removing noise may be required.

Techniques for extracting feature points from data, big data, etc., include sparse encoding or principal component analysis (PCA). Therefore, a sparse transform or principal component analysis (PCA) is performed to generate a feature point in order to convert the signal into a base function form (230). Sparse encoding or PCA is one of the typical ways of converting specific data or signals into basis functions. Thus, various other schemes for extracting only features from the signal may be used.

The feature point is expressed as a basis function and a coefficient. An excessively high-dimensional signal can reduce the dimension of the function because it requires a large amount of computation and sometimes leads to an incorrect result (240).

Since the noise removal process 220, the base functionization process 230, and the dimension reduction process 240 can use techniques disclosed in various studies for conventional signal analysis, a detailed description will be omitted.

Thereafter, the signal generated or acquired by the electronic device is analyzed 250 using standard feature points corresponding to the classifier learned in advance.

Meanwhile, the target device may have various driving states. For example, there may be a normal driving state, a driving state consuming a large amount of energy, a standby state consuming less energy, and the like. Therefore, it is preferable that standard feature points according to the respective driving states of the target device are provided in advance and the current driving state is determined, and the current signals of the electronic device are compared with corresponding standard feature points.

Electronic devices and signals to be analyzed. The electronic device transmits the signal to a separate collecting device or a calculating device corresponding to the central control device, and the target device collects the signal or acquires the signal through the receiving device. If the central control unit receives a signal, the central control unit can analyze the signal.

The electronic device may be at least one of a communication device, an audio device, a video device, or a sensor device. The communication device includes a communication module connected to an external network and a communication module included in the internal electronic device and performing internal communication. The sensor device is a device that collects peripheral information or a device that generates a specific signal according to an external input.

On the other hand, the signal to be analyzed by the target device may be a signal transmitted by one or more electronic devices. That is, it is possible to analyze signals transmitted by a plurality of electronic devices simultaneously or at intervals. In this case, one low-dimensional signal, which is a signal transmitted from each electronic device, is combined to generate one high-dimensional signal, and a low-level signal is used to generate the groundwater. That is, when a plurality of electronic devices exist in the target device or when signals are generated according to different inputs in one electronic device, the signals to be analyzed may be various combinations of types.

In some cases, feature points may be extracted from signals generated by a plurality of electronic devices, and analysis may be performed on a set of feature points obtained by combining feature points of each electronic device.

3 is an example of a feature point distribution. FIG. 3 shows an example of three-dimensional coordinates. Variables corresponding to each axis can be various values. For example, the signal generated in one electronic device may be the intensity of a signal that is x-axis time, y-axis frequency, and z-axis. Or a signal generated by a plurality of electronic devices, one axis may be a type of the electronic device. Or a combination of signals by various methods, signals can be represented corresponding to respective axes before combining.

3 illustrates an example of three-dimensional coordinates, the minutiae may be distributed in two-dimensional coordinates or in four-dimensional or more coordinates. As a result, it can be said that the feature point is located at a coordinate having at least two axes among the coordinate axes including time, frequency, kind of electronic device, signal intensity, and the like. The multidimensional coordinates may correspond to a smaller degree of coordinates by the diminishing process 240.

In the signal analysis step 150, 250, if the distribution of the standard feature point and the distribution of the feature point in the case where the target device is in an abnormal state of the electronic device is equal to or more than the reference value, it can be determined that the signal is in an abnormal state. Or if the distribution of the standard feature points and the distribution of the feature points in the case where the target apparatus is in the normal state of the electronic apparatus is not equal to or more than the reference value, the signal may be determined as an abnormal state. As a result, the distribution of the minutiae points of the signal to be analyzed and the distribution of the standard minutiae points are compared with each other to determine whether the signals are in an abnormal state whether they are located in a certain region or are out of the region.

For example, if there is a learned region showing a steady state, it can be determined that all of the feature points are located in a normal state, and the feature points are out of a region of a normal state, Conversely, if there is a learned region indicating an abnormal state, it may be determined that an abnormal state is present if all of the feature points are located in the corresponding region, and the feature point is out of the region of some abnormal state.

A method 100 for monitoring network attacks by monitoring electronic device signals as described above may be applied to a variety of target devices. Hereinafter, a description will be given of a vehicle corresponding to one of the target devices.

4 is an example of a block diagram showing the configuration of the automobile 500 that analyzes the ECU signal to detect a network attack. The vehicle 500 that analyzes the ECU signal to detect a network attack includes a communication device 540 that exchanges data with an external network device, an electronic device 510 that transmits the generated signal through an internal communication module using a vehicle communication protocol A memory device 530 for storing standard feature points of a standard signal generated by the electronic device in at least one of a steady state or an abnormal state of the electronic device and a feature point extraction section for extracting feature points from the signal generated by the electronic device, And an ECU device 520 for comparing standard feature points to determine whether or not the vehicle is in an abnormal state.

The automobile 500 shown in FIG. 4 corresponds to a vehicle that performs communication with an external network. External communication is performed through the vehicle's communication device 540 and the direct object with which the communication device 540 communicates is either a road side unit (RSU) 508 located near the road or a base station It may be a base station (AP, 50B) for short-range wireless communication or another vehicle 50C located in the vicinity of the VANET. The communication device 540 transmits a predetermined signal or data to the ECU device 520 and transmits a signal from the ECU device 520 to the outside.

In FIG. 4, some of the various electronic devices 510 included in the automobile are shown as an example. The deceleration pedal 510A, the accelerator pedal 510B, the braking device 510C and the engine device 510D are shown as an example for the electronic device 510. [

As described above, the current car is not connected to each other by wire, and a certain signal is transmitted to the ECU (Central Processing Unit) through a short range wireless communication (CAN) according to the degree that the user depresses the deceleration pedal 510A. (electronic control unit) device 520, and the ECU device 520 analyzes the signal and transmits a deceleration signal of a certain degree to the braking device 510C mounted on the wheel. Also, even when the accelerator pedal 510B is bright, a constant signal is transmitted to the engine device 510D via the ECU device 520 via the CAN. Details of deceleration and acceleration and specific parts involved are the same as common sense in the field, so the description is omitted.

When the target device is an automobile, the electronic device 510 corresponds to at least one of a steering device, a braking device, a lighting device, a power generating device, a power transmitting device, a power control device, an audio device, a video device, . The lighting device is meant to include an exterior lighting and an interior lighting device. The power control device includes an accelerator pedal, a valve of an engine, and the like.

The ECU device 520 extracts feature points in the form of a basis function by applying a feature point extraction technique to the signal of the electronic device. As described above, the feature point extraction technique includes sparse coding or principal component analysis (PCA). The standard feature point corresponds to the feature point for the standard signal of the electronic device which occurs in advance in at least one of the steady state or the abnormal state. Feature point extraction and standard feature point preparation are the same as described above.

The ECU apparatus 520 determines that the signal is in an abnormal state when the distribution of the standard feature point and the feature point in the abnormal state of the electronic apparatus coincide with the reference value or more or the standard feature point distribution and the distribution of the feature point in the normal state of the electronic apparatus are If it does not coincide with the reference value or more, it is judged that the signal is in an abnormal state. This is the same as the method 100 for monitoring network attacks by monitoring the electronic device signals described above.

Further, the signals generated by the various electronic devices 510 of the automobile may vary depending on the running state of the automobile or the like. For example, signals generated in the electronic device 510 may vary depending on the constant speed running state, the acceleration state, the deceleration state, or the stop state. Accordingly, standard feature points are provided in advance for the constant speed running state, the acceleration state, the deceleration state, and the stop state, and the ECU device 520 determines the current state of the vehicle, It is preferable to determine whether the signal is in an abnormal state by comparing the corresponding standard feature points of the signal.

On the other hand, the ECU device 520 may transmit information to the external network device via the communication device whether the electronic device is in a normal state or an abnormal state. In the case of a system that controls a vehicle using a VANET, the central control system requires certain information to control the situation of each vehicle.

It should be noted that the present embodiment and the drawings attached hereto are only a part of the technical idea included in the above-described technology, and those skilled in the art will readily understand the technical ideas included in the above- It is to be understood that both variations and specific embodiments which can be deduced are included in the scope of the above-mentioned technical scope.

500: vehicle 510: electronic device
520: ECU device 530: memory device
540: Communication device 50A: RSU
50B: AP 50C: Other cars

Claims (14)

The method comprising: receiving at least one electronic device, wherein a target device communicating information with an external network device via a communication module obtains a signal of the electronic device;
The target device extracting feature points from the signal; And
And comparing the feature point with standard feature points previously provided by the target device to determine whether the signal is in an abnormal state. The method according to claim 1,
The obtaining step
Wherein the target device is monitoring an electronic device signal from the electronic device acquiring the signal received by the signal acquisition device or computing device within the target device. The method according to claim 1,
The electronic device
A method for monitoring a network attack by monitoring an electronic device signal that is at least one of a communication device, an audio device, a video device, or a sensor device. The method according to claim 1,
In the extracting step
Wherein the target device monitors an electronic device signal extracting the minutiae points as a basis function by applying a minutia analysis technique to the signal to detect a network attack. 5. The method of claim 4,
Wherein the feature point is located at a coordinate having at least two axes of a time axis, a frequency, a kind of an electronic device, and a coordinate axis including a strength of a signal. The method according to claim 1,
Before the obtaining step
Acquiring a standard signal of the electronic device in which the target device occurs in at least one of a normal state and an abnormal state in advance, extracting characteristic points for the standard signal, extracting the standard characteristic points, and storing the standard characteristic points in a memory device Further comprising the steps of: detecting an electronic device signal, The method according to claim 1,
The determining step
Determining that the signal is in an abnormal state if the distribution of the standard feature point and the distribution of the feature points in the case where the target device is in an abnormal state of the electronic device is equal to or more than a reference value, And monitoring the electronic device signal for determining that the signal is in an abnormal state if the distribution of the standard feature point and the distribution of the feature point do not match the reference value or more. A communication device for exchanging data with an external network device;
An electronic device for transmitting the generated signal through an internal communication module;
A memory device for storing standard feature points of a standard signal generated by the electronic device in at least one of a steady state or an abnormal state of the electronic device; And
And an ECU device for extracting a feature point from the signal generated by the electronic device and comparing the extracted feature point with the standard feature point to determine whether or not it is in an abnormal state, A car that detects network attacks by analyzing signals. 9. The method of claim 8,
The electronic device
An automobile that detects a network attack by analyzing an ECU signal, which is at least one of a steering device, a braking device, a lighting device, a power generating device, a power transmitting device, a power control device, an audio device, a video device, a dashboard device or a navigation device. 9. The method of claim 8,
The ECU device
And analyzing an ECU signal for extracting the feature points in a base function form by applying a feature point analysis technique to the signal to detect a network attack. 9. The method of claim 8,
The standard feature points
Wherein a network attack is detected by analyzing an ECU signal which is a feature point of a standard signal of the electronic device which occurs in at least one of a normal state or an abnormal state in advance. 10. The method of claim 9,
The ECU device
Wherein the control unit determines that the signal is in an abnormal state when the distribution of the standard feature point and the distribution of the feature points in the abnormal state of the electronic apparatus are equal to or greater than a reference value or determines that the standard feature point distribution and the distribution The ECU analyzes the ECU signal to determine that the signal is in an abnormal state to detect a network attack. 10. The method of claim 9,
The ECU device
Wherein the ECU analyzes the ECU signal transmitting the information on whether the electronic device is in a normal state or an abnormal state to the external network device through the communication device to detect a network attack. 10. The method of claim 9,
Wherein the memory device stores standard feature points for each of the constant speed running state, the acceleration state, the deceleration state, and the stop state of the automobile, and the ECU device is configured to store standard feature points according to the current driving state of the automobile and feature points And detects a network attack by analyzing an ECU signal that determines whether or not the vehicle is in an abnormal state.

Images