KR20190063209A - Device for verifying status and detecting anomaly of vehicle and system having the same - Google Patents

Abstract

Disclosed is a detection device for detecting signs of abnormality in a vehicle and verifying an abnormality in the condition of the vehicle. The detection device comprises: a receiving unit which receives a plurality of controller area network (CAN) messages from a first terminal mounted in a vehicle; a sign-of-abnormality detection unit which uses the CAN messages to determine whether signs of abnormality are present in the vehicle; and a transmission unit which transmits the determination result of the sign-of-abnormality detection unit to a second terminal, wherein the sign-of-abnormality detection unit calculates a CAN ID entropy of CAN messages in a first group among the CAN messages, and determines that signs of abnormality have occurred when the calculated entropy is outside of a predetermined range.

Description

BACKGROUND OF THE INVENTION 1. Field of the Invention [0001] The present invention relates to a vehicle state verifying apparatus,

The present invention is directed to a method for verifying a vehicle condition remotely and detecting a rapid anomaly on a small vehicle in place of an in-vehicle device with low performance.

With the development of the Internet of Things (IoT) technology, the market for autonomous vehicles that increase the driver 's convenience has been expanding, and security technology has become a prerequisite for the use of autonomous vehicles. NHATSA (National Highway Traffic Safety Administration) is reviewing the need for safety standards related to vehicle electronic systems in Automotive Electronic Control and Security, and emphasizes intrusion detection research.

Recently, autonomous mobile based automobile consists of sensing, signal processing (recognition), judgment and control process. Outside the vehicle, ADAS (Advanced Driver Assistance Systems) sensors and wireless communication provide information about the surrounding area of the vehicle. The decision process in the vehicle determines the driving strategy based on the determination of the presence of a dangerous situation. The control system in the vehicle finally controls the vehicle according to the driving strategy determined by the determination process.

However, since the final control right of an autonomous vehicle is an electronic control unit (ECU) of an internal network, it is vulnerable to attacks such as malicious manipulation of a communication network inside the vehicle. The introduction of open networks such as V2X (Vehicle to Everything) and VANET (Vehicular ad hoc network) facilitates access to the internal network of the vehicle. An attack that affects the safety of the driver can be carried out by operating.

In addition, a large number of electronic control systems and software are mounted for efficient communication between the external and internal devices of the vehicle, and the complexity of the internal system of the vehicle is continuously increasing. Computing performance of in-vehicle electronic devices is limited to encompassing many such electronic systems, and therefore research on anomalous symptom detection module of high computing performance applicable to a compromised ECU device is required.

Recently released vehicles are equipped with numerous electronic control systems and software, as well as various ADAS sensor modules to recognize vehicle surroundings information. Vehicle internal network communication is performed through CAN (Controller Area Network), FlexRay, and LIN (Local Interconnect Network) protocols. If an attacker can enter the protocol bus, Lt; / RTI >

Accordingly, the present invention can be used for researching vehicle intrusion detection technology because it is possible to detect anomalous signs quickly from a remote location and easily compare and analyze information data of a plurality of collected vehicles.

United States Patent No. 9,703,955 Korean Patent Publication No. 2016-0071980 Korean Patent No. 1789734

Recently developed vehicles have a complex internal system structure because they are developed by combining or improving existing ADAS systems. Therefore, if the abnormality detection method is limited to one vehicle, it can be a method dependent on the electronic device of the corresponding vehicle.

Currently commercially available ECU devices in a vehicle have a performance that is insufficient to handle large-capacity arithmetic such as abnormal symptom detection. That is, there is a realistic difficulty in controlling various internal devices of a currently advanced vehicle in a vehicle.

The present invention proposes an intrusion detection method and apparatus suitable for a variety of commercial vehicle network and electronic device technologies, and provides a method for quickly detecting an attack on an internal system of a vehicle.

The detection apparatus according to an embodiment of the present invention includes a receiver for receiving a plurality of CAN messages from a first terminal mounted on the vehicle, an abnormality symptom detection unit for determining the presence or absence of an abnormality of the vehicle using the plurality of CAN messages, Wherein the abnormality symptom detection unit calculates the CAN ID entropy of the CAN messages of the first group among the plurality of CAN messages and transmits the CAN ID entropy of the first group of CAN messages to the second terminal, If it is outside the specified range, it is judged that an abnormal symptom has occurred.

In addition, the detection system according to the embodiment of the present invention includes the detection device, the first terminal, and the second terminal.

According to the embodiment of the present invention, it is possible to quickly detect an anomaly of a vehicle from a remote location, and to easily compare and analyze information data of a plurality of collected vehicles.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS In order to more fully understand the drawings recited in the detailed description of the present invention, a detailed description of each drawing is provided.
Figure 1 illustrates a system according to an embodiment of the present invention.
2 is a functional block diagram of the first terminal shown in FIG.
3 is a functional block diagram of the server shown in FIG.
Fig. 4 shows an example of CAN messages received by the receiver shown in Fig. 3 or CAN messages collected by the collector shown in Fig.
Fig. 5 shows an example of the status information (or vehicle data generated by the status verifying unit) received by the receiving unit shown in Fig. 3 or the status information collected by the collecting unit shown in Fig.
6 is a functional block diagram of the second terminal shown in FIG.

It is to be understood that the specific structural or functional description of embodiments of the present invention disclosed herein is for illustrative purposes only and is not intended to limit the scope of the inventive concept But may be embodied in many different forms and is not limited to the embodiments set forth herein.

The embodiments according to the concept of the present invention can make various changes and can take various forms, so that the embodiments are illustrated in the drawings and described in detail herein. It should be understood, however, that it is not intended to limit the embodiments according to the concepts of the present invention to the particular forms disclosed, but includes all modifications, equivalents, or alternatives falling within the spirit and scope of the invention.

The terms first, second, etc. may be used to describe various elements, but the elements should not be limited by the terms. The terms may be named for the purpose of distinguishing one element from another, for example, without departing from the scope of the right according to the concept of the present invention, the first element may be referred to as a second element, The component may also be referred to as a first component.

It is to be understood that when an element is referred to as being "connected" or "connected" to another element, it may be directly connected or connected to the other element, . On the other hand, when an element is referred to as being "directly connected" or "directly connected" to another element, it should be understood that there are no other elements in between. Other expressions that describe the relationship between components, such as "between" and "between" or "neighboring to" and "directly adjacent to" should be interpreted as well.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. The singular expressions include plural expressions unless the context clearly dictates otherwise. In this specification, the terms "comprises" or "having" and the like are used to specify that there are features, numbers, steps, operations, elements, parts or combinations thereof described herein, But do not preclude the presence or addition of one or more other features, integers, steps, operations, components, parts, or combinations thereof.

Unless defined otherwise, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs. Terms such as those defined in commonly used dictionaries are to be interpreted as having a meaning consistent with the meaning of the context in the relevant art and, unless explicitly defined herein, are to be interpreted as ideal or overly formal Do not.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings attached hereto.

Figure 1 illustrates a system according to an embodiment of the present invention.

A system 10, which may be referred to as a vehicle system, a detection system, a status verification and anomaly detection system, a remote vehicle status verification and an anomaly detection system, may include a first terminal 100, a server 300, 500).

The first terminal 100 collects messages (e.g., CAN (Controller Area Network) messages and / or status information) installed in the vehicle and transmitted on the in-vehicle network, collects the collected CAN messages and / To the server (300).

The server 300 may receive messages from the first terminal 100 and may determine whether there is an anomaly in the vehicle using the received messages. In addition, the server 300 receives status information from the first terminal 100 and verifies the status of the vehicle using the received status information (i.e., determines whether the status of the vehicle is abnormal). The determination result of the server 300 may be transmitted to the second terminal 500.

The second terminal 500 may receive the determination result from the server 300 and display the received determination result through a predetermined display unit. The second terminal 500 may be a portable terminal of the driver of the vehicle, but the present invention is not limited thereto. The second terminal may also refer to the first terminal 100 according to an embodiment.

2 is a functional block diagram of the first terminal shown in FIG.

Referring to FIGS. 1 and 2, a first terminal 100 includes a collecting unit 110 and a transmitting unit 130. The first terminal 100 may further include a storage unit 150 according to an embodiment.

The collection unit 110 may collect a plurality of messages transmitted in the vehicle network. For example, the collecting unit 110 may collect a plurality of CAN messages broadcast in the CAN of the vehicle. To this end, the collecting unit 110 may be connected to a CAN bus, a body control unit (BCM), or an on-board diagnostics-2 (OBD-2) terminal. According to an embodiment, the collecting unit 110 may include an interface unit connected to the CAN bus, the BCM, or the OBD-2 terminal. The plurality of CAN messages collected by the collecting unit 110 may be temporarily stored in the storage unit 150 at least temporarily.

The collecting unit 110 may collect the state information of the vehicle and store the collected state information in the storage unit 150. [ For example, the collecting unit 110 may transmit a query message regarding the current state of the vehicle through the OBD-2 terminal and receive status information from the vehicle.

The transmitting unit 130 transmits a plurality of messages and / or status information collected by the collecting unit 110 or a plurality of messages and / or status information stored in the storage unit 150 to the server 300 . At this time, a wireless communication network can be used, but the present invention is not limited thereto.

The storage unit 150 may at least temporarily store a plurality of messages collected by the collecting unit 110 and / or vehicle status information.

3 is a functional block diagram of the server shown in FIG.

3, a server 300, which may be referred to as a detection device, a detection server, and the like, includes a receiving unit 310, an abnormal symptom detecting unit 330, and a transmitting unit 370. According to an embodiment, the server 300 may further include at least one of the status verifying unit 350 and the storing unit 390. [

The receiving unit 310 receives the CAN messages and / or the vehicle status information from the first terminal 100, and the received CAN messages and / or the vehicle status information may be stored in the storage unit 390. An example of the CAN messages received by the receiver 310 or the CAN messages collected by the collector 110 is shown in FIG. Referring to FIG. 4, the CAN message may include a timestamp indicating a message generation time, a CAN message field including a priority of a message and a CAN ID for identification, and a CAN message field including data information.

)를 계산하고, 계산된 엔트로피(

)에 기초하여 차량의 이상 여부를 결정(또는 탐지)할 수 있다. 즉, 이상 징후 탐지부(330)는 계산된 엔트로피(

)가 미리 정해진 범위(정상 범위)를 벗어나는 경우(초과하거나 미만되는 경우) 차량에 이상이 발생한 것으로 판단할 수 있다. 기존에 발견되지 않았던 많은 종류의 CAN ID가 유입될 경우 다양성 지수가 상승하여 엔트로피 값이 증가하며, 특정 CAN ID가 유입될 경우 다양성 지수가 급격하게 낮아지기 때문에, 이를 반영하면 차량의 이상 여부를 판단할 수 있다.The abnormality symptom detection unit 330 detects whether the vehicle is abnormal (for example, jamming attack or spoofing) using the CAN messages received by the receiving unit 310 or the CAN messages stored in the storage unit 390. [ ) Attack or a malicious attack against a vehicle such as an attack). For example, the abnormal symptom detection unit 330 may perform an entropy-based abnormal symptom detection operation. Specifically, the abnormality symptom detection unit 330 detects the entropy of the CAN ID using the Shannon's diversity index formula (Equation 1)

), And the calculated entropy (

(Or detecting) an abnormality of the vehicle based on the detected vehicle speed. That is, the abnormality symptom detection unit 330 detects the calculated entropy (

) Is out of the predetermined range (normal range) (exceeds or falls below the predetermined range), it can be determined that an abnormality has occurred in the vehicle. When a large number of CAN IDs that have not been found before are introduced, the diversity index rises and the entropy value increases. When a specific CAN ID is inputted, the diversity index sharply decreases. .

은 미리 정해진 시간 구간 동안에 출현한 CAN ID의 개수를 의미하고,

는 상기 미리 정해진 시간 구간 동안에

개의 CAN ID 중

번째 CAN ID의 분포 확률(또는, 상기 미리 정해진 시간 구간 동안에 발생한 CAN 메시지의 개수 중 상기

번째 CAN ID를 포함하는 CAN 메시지의 비율)을 의미할 수 있다.In Equation (1)

Denotes the number of CAN IDs that have appeared during a predetermined time period,

For a predetermined period of time

Of CAN IDs

(I. E., The number of CAN messages generated during the predetermined time interval)

Lt; RTI ID = 0.0 > CAN < / RTI >

)는 주기적으로 계산될 수 있고, 상기 미리 정해진 시간 구간은 계산되는 주기와는 다를 수 있다. 예컨대, CAN ID 엔트로피(

)는 매초(또는 매 2초)마다 계산될 수 있고, 계산에 이용되는 CAN 메시지들은 2초(또는 1초) 동안 생성되거나 수신된 CAN 메시지들일 수 있다. 다른 예로, CAN ID 엔트로피(

)는 매초마다 계산될 수 있고, 계산에 이용되는 CAN 메시지들은 1초 동안 생성되거나 수신된 CAN 메시지들일 수도 있다.Entropy of CAN ID (

) May be calculated periodically, and the predetermined time period may be different from the period in which it is calculated. For example, CAN ID entropy (

) May be calculated every second (or every 2 seconds), and the CAN messages used for the calculation may be CAN messages generated or received for 2 seconds (or 1 second). As another example, CAN ID entropy (

) May be calculated every second, and the CAN messages used for the calculation may be CAN messages generated or received for one second.

The state verification unit 350 can generate vehicle data using the state information of the vehicle received from the vehicle. Since the state information of the vehicle received from the vehicle does not provide a direct numerical value regarding the engine RPM or the like, it is possible to generate the engine RPM or the like, that is, the vehicle data through additional processing. The vehicle data that can be generated by the state verifying unit 350 includes engine RPM, engine oil temperature, transmission oil temperature, vehicle speed, engine coolant temperature ). ≪ / RTI > An example of the status information received by the receiving unit 310 (or the vehicle data generated by the status verifying unit 350) or the status information collected by the collecting unit 110 is shown in FIG.

The state verifying unit 350 compares the generated vehicle data with a predetermined range (normal range), and when the vehicle outside the prescribed range (exceeds or falls below a predetermined range), for example, (revolutions per minute) is outside the range of 0 to 6000, the cooling water temperature is outside the range of 0 to 110 ° C, the vehicle speed is outside the range of -20 to 110 m / s, Can be determined.

The transmission unit 370 transmits the detection result of the abnormality symptom detection unit 330 (whether the vehicle is abnormal or malicious attack against the vehicle) and / or the verification result of the state verification unit 350 To the second terminal (500).

The storage unit 390 stores the vehicle messages (CAN messages) received by the receiving unit 310, the vehicle status information, the detection result of the abnormality symptom detection unit 330, the verification result of the state verification unit 350, Lt; / RTI >

6 is a functional block diagram of the second terminal shown in FIG.

The second terminal 500, which may be a mobile terminal carried by a driver of the vehicle or a terminal mounted on the vehicle, includes a receiving unit 510 and a display unit 530.

The receiving unit 510 may receive information on the vehicle abnormality from the server 300, that is, the determination result of the abnormality symptom determination unit 330.

The display unit 530 can display an abnormality of the vehicle received by the receiving unit 510. [ As described above, since the abnormality of the vehicle is displayed on the display unit and quickly transmitted to the driver, quick response is possible. According to the embodiment, the display unit 530 may output an alarm notification to notify the vehicle abnormality. Also, the display unit 530 may output the current state of the vehicle in the form of a table or a graph.

In this case, the first terminal 100 or the second terminal 500 may include a collecting unit 110, a transmitting unit 130, ), A storage unit 150, a receiving unit 510, and a display unit 530, as shown in FIG.

In addition, each of the configurations of the first terminal 100, the server 300, and the second terminal 500 shown in FIG. 2, FIG. 3, and FIG. 6 may be functionally and logically separated. May be easily deduced by an average expert in the field of the present invention that does not mean that the configuration of the device is divided into separate physical devices or written in a separate code.

Also, in this specification, "part" may mean a functional and structural combination of hardware for carrying out the technical idea of the present invention and software for driving the hardware. For example, the above-mentioned "part" may mean a logical unit of a predetermined code and a hardware resource for executing the predetermined code, and it does not necessarily mean a physically connected code or a kind of hardware .

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is evident that many alternatives, modifications and variations will be apparent to those skilled in the art. Accordingly, the true scope of the present invention should be determined by the technical idea of the appended claims.

10: system 100: first terminal
110: collecting unit 130: transmitting unit
150: storage unit 300: server
310: Receiving unit 330: Abnormal signal detection unit
350: state verification unit 370:
390: storage unit 500: second terminal
510: Receiving unit 530: Display unit

Claims (9)

A receiver for receiving a plurality of CAN (Controller Area Network) messages from a first terminal mounted on a vehicle;
An abnormality symptom detection unit for determining whether the vehicle has an abnormal symptom using the plurality of CAN messages; And
And a transmitter for transmitting the determination result of the abnormal symptom detection unit to the second terminal,
The abnormality symptom detection unit may detect a CAN ID entropy of a first group of CAN messages among the plurality of CAN messages

), And the calculated entropy (

) Is out of a predetermined range, it is determined that an abnormal symptom has occurred,
Detector.
The method according to claim 1,
The abnormality symptom detection unit may calculate the CAN ID entropy (

),
The equation

ego,
remind

Means the number of CAN IDs included in the CAN messages of the first group,

Quot;

Of CAN IDs

Lt; RTI ID = 0.0 > ID < / RTI >
Detector.
3. The method of claim 2,
The abnormal symptom is a jamming attack or a spoofing attack targeting the vehicle.
Detector.
The method according to claim 1,
The detection device further includes a status verifying unit,
Wherein the receiving unit further receives status information of the vehicle from the vehicle,
The state verifying unit generates vehicle data including at least one of revolutions per minute (rpm), engine oil temperature, vehicle speed, and engine coolant temperature from the state information And judging that an abnormality has occurred in the state of the vehicle when the generated vehicle data deviates from a predetermined second range,
Detector.
5. The method of claim 4,
Wherein the transmission unit transmits the determination result of the state verification unit to the second terminal,
Detector.
The method according to claim 1,
Wherein the first group of CAN messages are CAN messages generated during a predetermined time interval or received during the predetermined time interval,
Detector.
A detection device according to claim 1;
The first terminal; And
And the second terminal.
8. The method of claim 7,
The first terminal,
A collecting unit collecting the plurality of CAN messages broadcasted through a CAN bus of the vehicle; And
And a transmitter for transmitting the plurality of CAN messages to the server.
Detection system.
The detection system according to claim 4, wherein the detection system includes the first terminal and the second terminal,
The first terminal,
A collecting unit for collecting the plurality of CAN messages broadcasted through the CAN bus of the vehicle and the status information of the vehicle; And
And a transmitter for transmitting the plurality of CAN messages and the status information to the server,
The collecting unit receives the status information in response to a query message transmitted through an on-board diagnostics-2 (OBD-2) terminal of the vehicle.
Detection system.

Images