IDPS dynamic allocation device and method based on resource usage recognition

1 . An Intrusion Detection and Prevention System (IDPS) dynamic allocation device, comprising:

a resource amount information receiving unit configured to receive information about resource usage, including Electronic Control Unit (ECU) usage and IDPS usage, from an ECU resource amount measuring module;

a resource usage determining unit configured to determine whether the resource usage exceeds a usage allowance; and

a resource usage control unit configured to deactivate at least one detection method to reduce the IDPS usage when the resource usage exceeds the usage allowance,

wherein the resource usage control unit is configured to selectively deactivate a detection method that i) has a lowest priority based on a detection method priority table and ii) has at least one similar detection method, and

wherein the resource usage control unit is further configured to, when the detection method having the lowest priority in the detection method priority table does not have at least one similar detection method, select and deactivate a detection method having a lowest priority from among the detection methods, in the detection method priority table, that have at least one similar detection method.

2 . The IDPS dynamic allocation device of claim 1 , wherein the resource usage control unit is configured to, when the resource usage is less than the usage allowance, reactivate one or more deactivated detection methods to increase the IDPS usage within the usage allowance.

3 . The IDPS dynamic allocation device of claim 2 , wherein the resource usage control unit is configured to first activate a deactivated detection method having a highest priority among the one or more deactivated detection methods.

4 . The IDPS dynamic allocation device of claim 1 , wherein the detection method priority table includes a description of each of a plurality of detection methods, wherein the description is obtained from a detection method definition document.

5 . The IDPS dynamic allocation device of claim 4 , wherein:

the detection method priority table includes a priority determined based on a point assigned to each of the plurality of detection methods based on the description of each of the plurality of detection methods,

a plurality of similar groups including similar detection methods among the plurality of detection methods, and

average resource usage for each of the plurality of detection methods.

6 . The IDPS dynamic allocation device of claim 5 , further comprising:

an IDPS function performing unit configured to detect, in Controller Area Network (CAN) messages transmitted to or received from a CAN driver, abnormal messages that violate detection methods included in the detection method priority table, and

drop the detected abnormal messages.

7 . The IDPS dynamic allocation device of claim 6 , wherein the IDPS function performing unit is configured to adjust a priority associated with a particular detection method, among the plurality of detection methods, violated by an abnormal message, by additionally assigning a point to the particular detection method.

8 . The IDPS dynamic allocation device of claim 7 , wherein the resource usage control unit is configured to:

reflect the priority adjusted by the IDPS function performing unit to the detection method priority table in real time to update the detection method priority table, and

control the resource usage based on the updated detection method priority table.

9 . The IDPS dynamic allocation device of claim 1 , wherein the resource usage control unit is configured to set a detection method that performs the same checking function as an item for checking a Controller Area Network (CAN) message in Basic Software (BSW) to have the lowest priority when the basic software is written in AUTOSAR.

10 . An Intrusion Detection and Prevention System (IDPS) dynamic allocation method, comprising:

receiving information about resource usage, including Electronic Control Unit (ECU) usage and IDPS usage, from an ECU resource amount measuring module;

determining whether the resource usage exceeds a usage allowance; and

when the resource usage exceeds the usage allowance, selectively deactivating a detection method that i) has a lowest priority based on a detection method priority table and ii) has at least one similar detection method to reduce the IDPS usage, and

wherein selectively deactivating the detection method includes:

when the detection method having the lowest priority does not have at least one similar detection method, determining whether a detection method having the next lowest priority has at least one similar detection method; and

selecting and deactivating the detection method having the lowest priority from among the detection methods that have at least one similar detection method.

11 . The IDPS dynamic allocation method of claim 10 , further comprising, when the resource usage is less than the usage allowance, activating one or more deactivated detection methods to increase the IDPS usage within the usage allowance.

12 . The IDPS dynamic allocation method of claim 11 , wherein activating the one or more deactivated detection methods includes first activating a deactivated detection method having a highest priority among the one or more deactivated detection methods.

13 . The IDPS dynamic allocation method of claim 10 , wherein selectively deactivating the detection method includes managing and updating the detection method priority table for a plurality of detection methods based on a detection method definition document.

14 . The IDPS dynamic allocation method of claim 13 , wherein managing and updating the detection method priority table includes:

calculating and updating, in real time, a point for each of the plurality of detection methods based on a description of each of the plurality of detection methods,

grouping similar detection methods among the plurality of detection methods as a similar group, and

setting average resource usage for each of the plurality of detection methods.

15 . The IDPS dynamic allocation method of claim 14 , further comprising:

detecting, in Controller Area Network (CAN) messages transmitted to or received from a CAN driver, abnormal messages that violate detection methods included in the detection method priority table, and

dropping the detected abnormal messages.

16 . The IDPS dynamic allocation method of claim 15 , further comprising adjusting a priority associated with a particular detection method, among the plurality of detection methods, violated by an abnormal message, by additionally assigning a point to the particular detection method.

17 . The IDPS dynamic allocation method of claim 16 , further comprising:

reflecting the adjusted priority to the detection method priority table in real time to update the detection method priority table, and

selecting a detection method to be deactivated based on the updated detection method priority table.

18 . The IDPS dynamic allocation method of claim 10 , further comprising setting a detection method that performs the same checking function as an item for checking a Controller Area Network (CAN) message in Basic Software (BSW) to have the lowest priority when the basic software is written in AUTOSAR.