As the amount of in-vehicle data and number of in-vehicle functions have increased, automotive Ethernet and IP-based protocols have been adopted in vehicles. The scalable service-oriented middleware over IP (SOME/IP) protocol is designed for sending periodic or direct control messages and for updating or appending scalable functions. International regulation UN R-155 requires security monitoring to analyze and detect cyber-threats, vulnerabilities, and cyber-attacks from vehicle data and logs. SOME/IP also should be monitored from the perspective of security. We report a classification of use cases and possible attack patterns for SOME/IP, and we propose an intrusion detection system (IDS) that achieves high accuracy by combining two whitelist-based anomaly detection algorithms. The first is a real-time algorithm that compares received SOME/IP packets with a normal communication model to determine whether they are anomalies. The attack patterns covered in this paper include sophisticated malicious packets that are difficult for the real-time detection algorithm to distinguish from normal packets. Hence, the second algorithm performs retroactive detection by determining whether packets are anomalous from long-term time characteristics spanning an entire SOME/IP session. Although the retroactive algorithm takes longer for detection, we confirm a high level of detection accuracy for the proposed IDS, with a true positive rate of 0.91 and a false positive rate of 0.052.


    Access

    Check access

    Check availability in my library

    Order at Subito €


    Export, share and cite



    Title :

    SOME/IP Intrusion Detection System Using Real-Time and Retroactive Anomaly Detection


    Contributors:


    Publication date :

    2022-06-01


    Size :

    763771 byte





    Type of media :

    Conference paper


    Type of material :

    Electronic Resource


    Language :

    English



    Signature-Anomaly Based Intrusion Detection Algorithm

    Kumar, Roshan / Sharma, Deepak | IEEE | 2018


    MAIDENS: MIL-STD-1553 Anomaly-Based Intrusion Detection System Using Time-Based Histogram Comparison

    Genereux, Sebastien J. J. / Lai, Alvin K. H. / Fowles, Craig O. et al. | IEEE | 2020


    Anomaly Based Intrusion Detection for an Avionic Embedded System

    Damien, Alienor / Alata, Eric / Fumey, Marc et al. | SAE Technical Papers | 2018


    Anomaly Based Intrusion Detection for an Avionic Embedded System

    Damien, Alienor / Fumey, Marc / Alata, Eric et al. | British Library Conference Proceedings | 2018


    RETROACTIVE ANALYSIS FOR CARRIER OPERATION

    MICHAEL J WOICEKOWSKI / ALEJANDRO OSWALDO HERNANDEZ ROMERO / OLEKSANDR BASANETS | European Patent Office | 2017

    Free access