In-vehicle network attack detection method and apparatus

1. A controller area network (CAN) attack detection apparatus connected to a CAN bus for in-vehicle communication, the apparatus comprising:

a CAN driver including a first microprocessor and configured to:

sense and manage an obstacle of the CAN bus;

transmit a physical message to the CAN bus; and

receive the physical message from the CAN bus;

a CAN controller including a second microprocessor and configured to:

transmit a protocol message to the CAN driver; and

receive the protocol message from the CAN driver;

a microcontroller including a third microprocessor and configured to:

interface with the CAN controller; and

provide various applications;

wherein at least one of the microcontroller or the CAN controller is configured to execute:

a learning module configured to identify a CAN identifier (ID) upon receiving a predefined CAN packet and to generate learning statistical information expressed as bits with respect to a data field corresponding to the identified CAN ID;

a profiling module configured to maintain the learning statistical information received from the learning module and a precollected attack type; and

a detection module configured to:

extract a CAN ID and a bit stream of a data field from a real-time input CAN packet, and

determine a weight parameter of a connection line between nodes of a neural network using the learning statistical information acquired from the profiling module,

input the extracted bit stream to an input layer of the neural network, and

determine whether an attack is detected, based on an output value from an output layer of the neural network,

wherein the output value from the output layer is calculated by a nonlinear combination of an output value of at least one hidden layer of the neural network.

2. The apparatus according to claim 1 , wherein the detection module is configured to transmit the real-time input CAN packet to the profiling module upon determining that the attack is detected according to the output value from the output layer, and the profiling module is configured to update the precollected attack type using a CAN packet detected as an attack packet.

3. The apparatus according to claim 1 , wherein the detection module determines whether the attack is detected by determining whether the real-time input CAN packet is a CAN packet corresponding to the precollected attack type.

4. The apparatus according to claim 1 , wherein the learning module is configured to extract an interest point based on the learning statistical information expressed as the bits.

5. The apparatus according to claim 4 , wherein the learning module is configured to select at least one partial specific bit stream in the bit stream of the data field as the interest point.

6. The apparatus according to claim 5 , wherein the detection module is configured to input a bit stream corresponding to the selected interest point to the neural network.

7. The apparatus according to claim 5 , wherein the interest point includes at least one of a bit stream expressing mode information and a bit stream expressing number information.

8. The apparatus according to claim 4 , wherein the learning module is configured to select the interest point in units of bits based on variation of units of bits in the bit stream of the data field over time.

9. The apparatus according to claim 8 , wherein the variation of units of bits is calculated by an exclusive-OR operation on data field regions of two consecutive CAN packets.

10. The apparatus according to claim 1 , wherein the predefined CAN packet includes a CAN packet of a normal state and a CAN packet of an abnormal state.

11. A controller area network (CAN) attack detection apparatus connected to a CAN bus for in-vehicle communication, the apparatus comprising:

a CAN driver including a first microprocessor and configured to:

sense and manage an obstacle of the CAN bus;

transmit a physical message to the CAN bus; and

receive the physical message from the CAN bus;

a CAN controller including a second microprocessor and configured to:

transmit a protocol message to the CAN driver; and

receive the protocol message from the CAN driver;

a microcontroller including a third microprocessor and configured to:

interface with the CAN controller; and

provide various applications;

wherein at least one of the microcontroller or the CAN controller is configured to execute:

a learning module configured to generate learning statistical information expressed as bits upon receiving a predefined CAN packet, by extracting a bit stream of the predefined CAN packet matching a template region configured in units of fields constituting a CAN data frame;

a profiling module configured to maintain the generated learning statistical information and a precollected attack type; and

a detection module configured to:

extract a bit stream matching the template region from a real-time input CAN packet,

determine a weight parameter of a connection line between nodes of a neural network using the generated learning statistical information for the template region,

input the extracted bit stream to an input layer of the neural network, and

determine whether an attack is detected, based on an output value from an output layer of the neural network,

wherein the output value from the output layer is calculated by a nonlinear combination of an output value of at least one hidden layer of the neural network.

12. A method for detecting an attack on a controller area network (CAN) by a CAN attack detection apparatus connected to a CAN bus for in-vehicle communication, the method comprising:

sensing and managing, by a CAN driver, an obstacle of the CAN bus;

transmitting, by the CAN driver, a physical message to the CAN bus;

receiving, by the CAN driver, the physical message from the CAN bus;

transmitting, by a CAN controller, a protocol message to the CAN driver;

receiving, by the CAN controller, the protocol message from the CAN driver;

interfacing, by a microcontroller, with the CAN controller and providing various applications;

identifying, by at least one of the microcontroller or the CAN controller, a CAN identifier (ID) upon receiving a predefined CAN packet and generating and storing learning statistical information expressed as bits with respect to a data field corresponding to the identified CAN ID;

extracting, by at least one of the microcontroller or the CAN controller of a vehicle, a CAN ID and a bit stream of a data field from a real-time input CAN packet;

determining, by at least one of the microcontroller or the CAN controller of a vehicle, a weight parameter of a connection line between nodes of a neural network based on the learning statistical information corresponding to the extracted CAN ID;

inputting, by at least one of the microcontroller or the CAN controller of a vehicle, the extracted bit stream to an input layer of the neural network; and

determining whether an attack is detected, based on an output value from an output layer of the neural network,

wherein the output value from the output layer is calculated by a nonlinear combination of an output value of at least one hidden layer of the neural network.

13. The method according to claim 12 , further comprising:

maintaining information about a precollected attack type in a predetermined recording region and, when the attack is determined according to the output value from the output layer, updating the precollected attack type using the real-time input CAN packet.

14. The method according to claim 13 , further comprising:

sensing an attack by determining whether the real-time input CAN packet is a CAN packet corresponding to the precollected attack type.

15. The method according to claim 12 , further comprising:

extracting an interest point based on the learning statistical information expressed as bits.

16. The method according to claim 15 , wherein the extracting the interest point comprises at least one of:

selecting at least one partial specific bit stream in the bit stream in the data field as the interest point; or

selecting the interest point in units of bits based on variation of units of bits in the bit stream in the data field over time.

17. The method according to claim 16 , wherein a bit stream or a bit selected as the interest point is input to the neural network.

18. The method according to claim 16 , wherein, when the partial specific bit stream is selected as the interest point, the interest point includes at least one of a bit stream expressing mode information or a bit stream expressing number information.

19. The method according to claim 16 , wherein the variation of units of bits is calculated by an exclusive-OR operation of units of bits on data field regions of two consecutive CAN packets.

20. A method for detecting an attack on a controller area network (CAN) by a CAN attack detection apparatus connected to a CAN bus for in-vehicle communication, the method comprising:

sensing and managing, by a CAN driver, an obstacle of the CAN bus;

transmitting, by the CAN driver, a physical message to the CAN bus;

receiving, by the CAN driver, the physical message from the CAN bus;

transmitting, by a CAN controller, a protocol message to the CAN driver;

receiving, by the CAN controller, the protocol message from the CAN driver;

interfacing, by a microcontroller, with the CAN controller and providing various applications;

generating and storing, by at least one of the microcontroller or the CAN controller, learning statistical information expressed as bits upon receiving a predefined CAN packet, by extracting a bit stream of the predefined CAN packet matching a template region configured in units of fields constituting a CAN data frame; and

extracting, by at least one of the microcontroller or a CAN controller of the vehicle, a bit stream matching the template region from a real-time input CAN packet, determining a weight parameter of a connection line between nodes of a neural network using the generated learning statistical information for the template region, inputting the extracted bit stream to an input layer of the neural network, and determining whether an attack is detected, based on an output value from an output layer of the neural network,

wherein the output value from the output layer is calculated by a nonlinear combination of an output value of at least one hidden layer of the neural network.