KR20200130968A - A system and method for detecting network anomalies of connected car - Google Patents

Abstract

The present invention relates to a system for detecting the abnormality of a connected car network. An object of the present invention is to provide a safer autonomous driving environment for a user by detecting abnormality in real time to maximize cyber security. The system includes: an ANSG program inspecting, detecting, and blocking a packet transmitted between internal and external networks; and a simulation program simulating the security vulnerability of a target server and whether to perform network processing by transmitting a test packet and the vulnerability of the ANSG program. The ANSG program includes: a log detection module collecting information on a gateway connected to an external network and an internal network of an autonomous vehicle; an attack detection module receiving operation data in which a functional safety scenario is applied to the collected information; a threat identification module extracting a security vulnerability based on the operation data; an abnormality sign detection module determining whether an abnormality sign has been discovered based on the extracted security vulnerability; and a network separation unit separating the network of the internal network so that a mutual address cannot be known in the internal network.

Description

A system and method for detecting network abnormalities in connected vehicles {A SYSTEM AND METHOD FOR DETECTING NETWORK ANOMALIES OF CONNECTED CAR}

The present invention relates to a system and method for detecting network abnormalities of a connected vehicle, and more particularly, to provide a safer autonomous driving environment to users by detecting access and attacks from outside in real time in an autonomous vehicle network environment. It relates to a system and method for detecting network abnormalities in a connected vehicle.

In recent years, automobiles have developed into connected cars, smart cars, and the like, providing various convenient functions to drivers. Not only automobiles are evolving intelligently, but through linkage with traffic control systems such as driving roads and traffic lights, they are ultimately developing into intelligent transportation systems that reduce traffic accidents and increase traffic efficiency. However, as user convenience increases, various problems such as car theft and hacking occur.

This is because, unlike the existing network environment such as the Internet, in the vehicle network environment, whether or not security is secured is directly related to the life of the driver, and if the security is not secured, a dangerous situation may be caused.

In particular, in the case of a smart key among information and communication technologies provided for the convenience of a driver provided in a recent vehicle environment, securing security is very important. The smart key enables remote vehicle door opening and starting and remote starting by allowing the functions of the door opening and closing of the existing vehicle to be performed remotely. However, since the inside of a typical vehicle does not have a technical means to distinguish the vehicle owner, if such a smart key is lost or stolen, a third party other than the owner can access it, which can lead to crime and vehicle accidents. .

Therefore, since such damage can lead to damage to the vehicle owner, the need for development of security technology for autonomous vehicles is emerging.

The problem to be solved by the present invention is to provide a network anomaly symptom detection system and method of a connected vehicle capable of providing a safer autonomous driving environment to a user by maximizing cyber security elements by detecting anomaly in real time.

Another problem to be solved by the present invention is to provide a network anomaly detection system and method for connected vehicles capable of enhancing security by controlling external access in an autonomous vehicle network environment and detecting malicious access and attacks of attackers. To provide.

The problems of the present invention are not limited to the problems mentioned above, and other problems that are not mentioned will be clearly understood by those skilled in the art from the following description.

In order to solve the above-described problems, the system for detecting network abnormalities of a connected vehicle according to an embodiment of the present invention includes an ANSG program for inspecting, detecting, and blocking packets transmitted between an internal network and an external network; And a simulation program that simulates the security vulnerability and network processing of the target server by transmitting the vulnerability and test packets of the ANSG program. A log detection module; An attack detection module for receiving operation data applying a functional safety scenario to the collected information; A threat identification module for extracting a security vulnerability based on operation data; An abnormal symptom detection module that determines whether or not an abnormal symptom is found based on the extracted security vulnerability; And a network separation unit for separating a network of the internal network so that addresses between each other in the internal network are not known.

According to another feature of the present invention, it includes a database that stores data necessary for the operation of the ANSG program and the simulation program, and the database stores detection logs and patterns by the ANSG program, and is detected and blocked using this pattern. A first database for storing audits according to changes in settings such as detection details and patterns; And a second database for storing information on a network packet and information on a vulnerability scanner embedded in the simulation program.

According to another feature of the present invention, the network separation unit can be divided into a first internal network, a first internal network, and a second internal network from which mutual access is blocked.

According to another feature of the present invention, a detection history inquiry module for inquiring the detection history in real time may be further included.

According to another feature of the present invention, the functional safety scenario may detect firewall details in real time and extract a firewall pattern based on the detected firewall details.

In order to solve the above-described problem, the method for detecting network abnormalities in a connected vehicle according to another embodiment of the present invention collects information on a gateway connected to an external network of an autonomous vehicle and an internal network of the vehicle by a log detection module. Step to do; Receiving motion data obtained by applying a functional safety scenario to the information collected by the attack detection module; Extracting a security vulnerability based on operation data by a threat identification module; And detecting an abnormal symptom pattern based on the security vulnerability extracted by the abnormal symptom detection module.

According to another feature of the present invention, it includes a database that stores data necessary for the operation of the ANSG program and the simulation program, and the database stores detection logs and patterns by the ANSG program, and detection and blocking detection using this pattern A first database for storing audits according to changes in settings, such as details and patterns; And a second database for storing information on a network packet and information on a vulnerability scanner embedded in the simulation program.

According to another feature of the present invention, the internal network may include a first internal network and a second internal network in which mutual access is blocked with the first internal network.

Details of other embodiments are included in the detailed description and drawings.

The present invention can provide a safer autonomous driving environment to a user by maximizing cyber security factors by detecting abnormal signs in real time.

The present invention can control access from the outside in an autonomous vehicle network environment and detect malicious access and attacks by an attacker to enhance the degree of security.

The effects according to the present invention are not limited by the contents exemplified above, and more various effects are included in the present specification.

1 is a software configuration diagram of a network abnormality detection system for a connected vehicle.
2 is a diagram for explaining two program databases of a network abnormal symptom detection system of a connected vehicle.
3 is a hardware configuration diagram of a network abnormal symptom detection system of a connected vehicle.
4 is a flowchart illustrating a method of detecting abnormal symptoms of a connected vehicle.
5 is a block diagram illustrating two programs of an abnormal symptom detection system of a connected vehicle.
6 to 9 are exemplary diagrams for explaining an ANSG program.
10 to 12 are exemplary diagrams for explaining a Simulator program.

The following content merely illustrates the principle of the invention. Therefore, although those skilled in the art may implement the principles of the invention and invent various devices included in the concept and scope of the invention, although not clearly described or illustrated herein. In addition, it should be understood that all conditional terms and examples listed in this specification are, in principle, expressly intended only for the purpose of making the concept of the invention understood, and are not limited to the embodiments and states specifically listed as such. do.

In addition, in the following description, ordinal expressions such as first, second, etc. are intended to describe objects that are equivalent and independent of each other, and in the order of main/sub or master/slave It should be understood as meaningless.

The above-described objects, features, and advantages will become more apparent through the following detailed description in connection with the accompanying drawings, and accordingly, a person of ordinary skill in the technical field to which the invention pertains will be able to easily implement the technical idea of the invention. .

Each of the features of the various embodiments of the present invention can be partially or entirely combined or combined with each other, and as those skilled in the art can fully understand, technically various interlocking and driving are possible, and each of the embodiments can be implemented independently of each other, It may be possible to do it together in a related relationship.

Hereinafter, various embodiments of the present invention will be described in detail with reference to the accompanying drawings.

The following content merely illustrates the principle of the invention. Therefore, although those skilled in the art may implement the principles of the invention and invent various devices included in the concept and scope of the invention, although not clearly described or illustrated herein. In addition, it should be understood that all conditional terms and examples listed in this specification are, in principle, expressly intended only for the purpose of making the concept of the invention understood, and are not limited to the embodiments and states specifically listed as such. do.

In addition, in the following description, ordinal expressions such as first, second, etc. are intended to describe objects that are equivalent and independent of each other, and in the order of main/sub or master/slave It should be understood as meaningless.

The above-described objects, features, and advantages will become more apparent through the following detailed description in connection with the accompanying drawings, and accordingly, a person of ordinary skill in the technical field to which the invention pertains will be able to easily implement the technical idea of the invention. .

Each of the features of the various embodiments of the present invention can be partially or entirely combined or combined with each other, and as those skilled in the art can fully understand, technically various interlocking and driving are possible, and each of the embodiments may be independently implemented with respect to each other. It may be possible to do it together in a related relationship.

Hereinafter, various embodiments of the present invention will be described in detail with reference to the accompanying drawings.

Hereinafter, the configuration and operation of a network abnormal symptom detection system of a connected vehicle will be described in detail with reference to FIGS. 1 to 3.

1 is a software configuration diagram of a network abnormality detection system for a connected vehicle. FIG. 2 is a diagram for explaining two program databases of a network abnormal symptom detection system of a connected vehicle. 3 is a hardware configuration diagram of a network abnormal symptom detection system of a connected vehicle.

An abnormal symptom detection system of a connected vehicle is a system that detects abnormal symptoms of a vehicle in real time, and various functions are performed based on two program databases 300 and 400. Specifically, it collects information of the gateway connected to the external network of the autonomous vehicle and the internal network of the vehicle, applies a functional safety scenario, transmits data packets, receives and analyzes motion data, and extracts and prevents security vulnerabilities. can do.

In addition, the abnormal symptom detection system of the connected vehicle may be installed inside the gateway in the CAN network or may be connected to the bus as an independent entity to communicate with the gateway. In addition, it is possible to receive vehicle operation status information from the gateway and each controller (ECU), and monitor all messages on the corresponding CAN network.

In addition, the abnormal symptom detection system of connected vehicles transmits and measures signals by connecting to the gateway of autonomous vehicles and software that extracts security vulnerabilities in real time using the ANSG (Automotive Network Security Gateway) program and the Simulator program 200. It can be composed of hardware.

Here, the ANSG program 100 performs a role of inspecting, detecting, and blocking packets exchanged with each other inside/outside the network. 2, the database 300 of the ANSG program stores firewalls, intrusion detection and abnormal symptom patterns, and preset settings such as detection logs and detection patterns and abnormal symptom patterns that are detected and blocked using the stored patterns. The changed log can be saved based on.

In addition, the Simulator program 200 transmits a vulnerability or a test packet to simulate the security vulnerability of the target server and whether or not to process the network. At this time, vulnerability refers to a part that can be regarded as a potential threat or can develop into a threat. Referring to FIG. 2, information of a built-in network packet and information of a vulnerability scanner may be stored in a database 400 of a simulator program, and a simulation log using the same and a log according to a setting change may be stored.

Referring to FIG. 3, the network abnormal symptom detection system of a connected vehicle is configured such that the network is divided into external/internal by a network separation unit to be described later, or the internal network is divided into a first internal network and a second internal network again. Can be. The first internal network can be defined as a trust zone, that is, a trusted zone, and the second internal network can be defined as an untrust zone, that is, an untrusted zone. In this case, the first internal network and the second internal network may be set to block mutual access. Accordingly, since a plurality of systems or programs connected to the vehicle network cannot access each other, only the network designated by the user can be allowed and the rest can be prohibited, thereby enhancing the degree of security.

Hereinafter, the configuration and operation of the ANSG program and the Simulator program 200 will be described in detail with reference to FIGS. 4 to 12.

4 is a flowchart illustrating a method of detecting abnormal symptoms of a connected vehicle. 5 is a block diagram illustrating two programs of an abnormal symptom detection system of a connected vehicle. 6 to 9 are exemplary diagrams for explaining an ANSG program. 10 to 12 are exemplary diagrams for explaining the Simulator program.

First, information of a gateway connected to an external network of an autonomous vehicle and an internal network of the vehicle is collected by the log detection module 101 (S100). Subsequently, operation data obtained by applying a functional safety scenario to the collected information is received (S200). Subsequently, a security vulnerability is extracted based on the operation data (S300). Subsequently, an abnormal symptom pattern is detected based on the extracted security vulnerability (S400).

Referring to FIG. 5, the system for detecting abnormal symptoms of a connected vehicle includes an ANSG program 100 and a simulator program 200. Specifically, the ANSG program 100 may include a log detection module 101, an attack detection module 102, a threat identification module 103, an abnormal symptom detection module 104, and a network separation module 105.

The attack detection module 102 may receive operation data in which a functional safety scenario is applied to the collected information. Specifically, the attack detection module 102 collects data from all vehicles, programs, systems, etc. connected through a CAN network, and learns based on the collected data. By applying the functional safety scenario generated through learning to newly collected data and receiving motion data, it is possible to detect a malicious attack from a third party (for example, a hacker) based on a signature. As described above, since the present invention is based on detecting an attack based on a learning mode, it is possible to detect an attack based on logic without updating the signature. Accordingly, the network abnormal symptom detection system of the connected vehicle may be equipped with a protocol detection function. Accordingly, it is possible to support detection of a protocol executed in the application layer (L7) such as HTTP, and detection of various protocols other than HTTP.

The threat identification module 103 may extract a security vulnerability based on operation data. Specifically, it checks the security events of all autonomous vehicles connected through the CAN network and detects new threat patterns by analyzing the data of the autonomous vehicles. Here, it can be determined that the newly detected threat pattern is a security vulnerability, and that a threat has occurred in the security. Specific operations related to this will be described later.

The abnormal symptom detection module 104 may detect the abnormal symptom pattern based on the security vulnerability extracted by the threat identification module 103. When a pattern different from the functional safety scenario generated through learning is detected, the abnormal symptom pattern may be determined to have occurred. Specific operations related to this will be described later.

The network separation module 105 separates the network internally/externally in order to enhance security from a third party, and internally separates the network into a trusted area and an untrusted area. Therefore, since the separated internal networks are not interlocked with each other, the internal address cannot be known, and only desired information can be obtained through filtering.

Referring to FIG. 6, after selecting the'log tab 602' in the menu tab 610, and selecting the'real-time intrusion detection tab 607' menu, the intrusion detection history list 630 detected in real time can be checked. have. The detection details detected by the intrusion detection pattern can be displayed in real time. For example, the detected detection details may include a detection date and time, an action (permitted/blocked), a detection name, network information and protocol. In addition, when the operation control button 620 of FIG. 6 is used, the log detection module 101 may pause or start searching for details detected in real time. At this time, the HTTP application may be detected by the intrusion detection pattern.

Referring to FIG. 6, in the basic setting tab 603, it is possible to control each of the security settings, firewall settings, abnormal symptoms settings, and learning settings through on/off, and user's personal information (for example, ID, password, etc.) can also be set.

Referring to FIG. 6, in the advanced setting tab 604, detected patterns (firewall pattern, intrusion detection pattern, and abnormal symptom pattern) can be individually modified. For example, a pattern may be added, deleted, or a new pattern may be applied.

In addition, the log detection module 101 can receive all messages of the CAN network, as shown in Figs. 7 and 8, extract network information from the CAN message received for a certain period of time, and extract each from the extracted network information. You can also calculate network statistics. It is possible to collect information on the external network of the autonomous vehicle and the gateway connected to the internal network of the vehicle.

Referring to FIG. 7, when the'log tab 602' is selected in the menu tab 610 and the'real-time abnormal symptom tab 707' menu is selected, the abnormal symptom history list 730 detected in real time can be checked. have. The abnormal symptom details detected by the abnormal symptom pattern may be displayed in real time. For example, the detected abnormal symptom details may include a detection date and time, an action (whether permission/blocking), network information and protocol.

In addition, you can search all firewall details recorded on the selected date by selecting the search date tab (741), select the IP through the classification tab (742), and manually enter the desired search word in the search tab (743) You can also search the log for abnormal symptoms.

Referring to FIG. 8, after selecting the'log tab 602' in the menu tab 610, and selecting the'real-time network statistics tab 807' menu, a list of network statistics details 830 detected in real time can be checked. have. The network statistics detected by each of the patterns may be displayed in real time. For example, the detected network statistics include statistics date and time, Packets, Bytes, TCP, UDP, ICMP. May include authorization and blocking. At this time, the list of network statistics may be updated in units of seconds, minutes, hours, days, and weeks. In this case, the network statistics detail list 830 of FIG. 8 may be checked in a graph form, as shown in FIG. 8.

Referring to FIG. 8, a graph indicates how many networks are blocked and permitted for each time period, and how many protocols are detected for each time period. At this time, when the user clicks permit or block, the graph may or may not be viewed.

In addition, when selecting the'log tab 602' and then selecting the'audit log tab 907', it is possible to check which patterns have been added, modified, and deleted on the selected date. For example, the number of application of each pattern, whether each security setting is on or off, and whether or not a login has failed/success can be inquired. Specifically, when the security setting is On, a message saying "It is running normally" is displayed. When the security setting is Off, a message saying "Intrusion detection is not running normally" is displayed. can do.

In addition, the abnormal symptom details detected by the abnormal symptom pattern may be displayed in real time. For example, the detected abnormal symptom details may include a detection date and time, an action (whether permission/blocking), network information and protocol. In addition, although not shown in the drawing, it is possible to know from which country intrusion detection occurred based on the IP detected by country through the mark on the globe. For example, by marking the globe in the form of a bar, but displaying the length of the bar in proportion to the number of intrusion detections, it is possible to know how many intrusion attempts were made in which country.

In addition, statistics can be searched for each subject. At this time, the statistics for each target display the IP addresses of the targets detected intrusion in the form of images, but by displaying the font size differently in the order of the most detected intrusions, it is possible to know which targets attempted and how much intrusion.

Simulator program 200 is a program that can inquire and set test information, vulnerability information, setting information, program information, etc. performed by the ANSG program 100, and in more detail, functions such as packet test, scan check, packet setting, etc. Can be done. As shown in FIG. 10, when the test tab 1112 is selected, the test information field 1120 for checking the test information progressed in the test proceeding, and the vulnerability information field 1130 for checking the test information progressed in the vulnerability check. ) And a usage history information field 1140 that can check the changed details in the audit log may be displayed. At this time, for test information and vulnerability information, detailed results can be checked by selecting each tab (Proceed, Stop, Finish) from the results.

Specifically, the packet test function of the Simulator program 200 classifies packets based on the category values stored in the database 400 of the Simulator program, and when the user searches for the target system name and IP address to be tested, detailed information per packet To be able to confirm. For example, the detailed information for each packet may include the packet name, progress rate, progress status, and success rate of the target system under test.

In addition, the scan check function of the Simulator program 200 is a function used to check for vulnerabilities, and after classifying them into general scanners and web scanners based on the scans stored in the database 400 of the Simulator program, each scan list You can check their progress. For example, the progress status may include a scan tracking progress status, a scan start date and time, a scan end date and time, a target IP, a scan name, and a scan result.

Also, as shown in FIG. 12, whether to use a packet may be set by turning on/off for each packet. At this time, it is possible to check the modification date, category, usage, etc. for each packet.

Accordingly, the present invention has an effect of providing a safer autonomous driving environment to a user by maximizing cyber security factors by detecting abnormal signs in real time.

The present invention has an effect of controlling access from the outside in an autonomous vehicle network environment, detecting malicious accesses and attacks of an attacker, and enhancing the degree of security.

Although the embodiments of the present invention have been described in more detail with reference to the accompanying drawings, the present invention is not necessarily limited to these embodiments, and various modifications may be made without departing from the spirit of the present invention. . Accordingly, the embodiments disclosed in the present invention are not intended to limit the technical idea of the present invention, but to explain the technical idea, and the scope of the technical idea of the present invention is not limited by these embodiments. Therefore, it should be understood that the embodiments described above are illustrative in all respects and not limiting. The scope of protection of the present invention should be interpreted by the following claims, and all technical ideas within the scope equivalent thereto should be interpreted as being included in the scope of the present invention.

100: ANSG program 101: log detection module
102: attack detection module 103: threat identification module
104: abnormal symptom detection module 105: network separation module
200: Simulator program 300: ANSG program DB
400: Simulator program DB 610, 1110: Menu tab
620: motion control button 630: detection history list
730: abnormal symptom details list 630: network statistics details list
1000: network anomaly detection system for connected vehicles

Claims (8)

An ANSG program that inspects, detects, and blocks packets transmitted between an internal network and an external network; And a simulation program for simulating the security vulnerability and network processing of the target server by transmitting the vulnerability and test packet of the ANSG program,
The ANSG program includes: a log detection module for collecting information on an external network of an autonomous vehicle and a gateway connected to the internal network of the vehicle; An attack detection module for receiving operation data in which a functional safety scenario is applied to the collected information; A threat identification module for extracting a security vulnerability based on the operation data; An anomaly symptom detection module that determines whether an anomaly symptom is found based on the extracted security vulnerability; And a network separation unit for separating a network of the internal network so that addresses between the internal networks cannot be known within the internal network,
Network abnormality detection system for connected vehicles. The method of claim 1,
And a database storing data necessary for the operation of the ANSG program and the simulation program,
The database includes: a first database that stores detection logs and patterns by the ANSG program, and stores detection details detected and blocked using the patterns and audits according to changes in settings, such as patterns; And a second database for storing information of a network packet and information of a vulnerability scanner embedded in the simulation program,
Network abnormality detection system for connected vehicles. The method of claim 1,
The internal network,
Divided into a first internal network and a second internal network that is mutually blocked from access by the network separation unit,
Network abnormality detection system for connected vehicles. The method of claim 1,
Further comprising a detection history inquiry module for inquiring the detection history in real time,
Network abnormality detection system for connected vehicles. The method of claim 1,
The functional safety scenario detects firewall details in real time, and extracts a firewall pattern based on the detected firewall details,
Network abnormality detection system for connected vehicles. Collecting information on a gateway connected to an external network of the autonomous vehicle and an internal network of the vehicle by a log detection module;
Receiving motion data obtained by applying a functional safety scenario to the information collected by the attack detection module;
Extracting a security vulnerability based on the operation data by a threat identification module; And
Including the step of detecting an abnormal symptom pattern based on the extracted security vulnerability by the abnormal symptom detection module,
Network abnormality detection method of connected vehicle. The method of claim 6,
It includes a database that stores data necessary for the operation of ANSG programs and simulation programs,
The database includes: a first database that stores detection logs and patterns by the ANSG program, and stores detection details detected and blocked using the patterns and audits according to changes in settings, such as patterns; And a second database for storing information of a network packet and information of a vulnerability scanner embedded in the simulation program,
Network abnormality detection method of connected vehicle. The method of claim 6,
The internal network includes a first internal network and a second internal network in which mutual access is blocked with the first internal network,
Network abnormality detection method of connected vehicle.

Images