Connected cars need robust protection against network attacks. Network anomaly detection and prevention on board will be particularly fast and reliable when situated on the lowest possible layer. Blocking traffic on a low layer, however, causes severe harm if triggered erroneously by falsely positive alarms. In this paper, we introduce and evaluate a concept for detecting anomalous traffic using the ingress control of Time-Sensitive Networking (TSN). We build on the idea that already defined TSN traffic descriptors for in-car network configurations are rigorous, and hence any observed violation should not be a false positive. Also, we use Software-Defined Networking (SDN) technologies to collect and evaluate ingress anomaly reports, to identify the generating flows, and to ban them from the network. We evaluate our concept by simulating a real-world zonal network topology of a future car. Our findings confirm that abnormally behaving individual flows can indeed be reliably segregated with zero false positives.
Network Anomaly Detection in Cars based on Time-Sensitive Ingress Control
2020-11-01
1555047 byte
Conference paper
Electronic Resource
English
Anomaly detection electronic control unit, onboard network system, and anomaly detection method
European Patent Office | 2021
|ANOMALY DETECTION ELECTRONIC CONTROL UNIT, ONBOARD NETWORK SYSTEM, AND ANOMALY DETECTION METHOD
European Patent Office | 2019
|ANOMALY DETECTION ELECTRONIC CONTROL UNIT, IN-VEHICLE NETWORK SYSTEM, AND ANOMALY DETECTION METHOD
European Patent Office | 2020
|Anomaly detection electronic control unit, in-vehicle network system, and anomaly detection method
European Patent Office | 2022
|