APPARATUS AND METHOD FOR DETECTING IN-VEHICLE NETWORK ATTACK

摘要

An apparatus for detecting an in-vehicle network attack, is configured to cumulatively count packets for each device that has a respective ID and is connected to an in-vehicle network bus. The apparatus is configured to cumulate a check value every time the packets are cumulatively counted to calculate a cumulated value, and determine that an attack is conducted when an average cumulated value obtained by dividing the cumulated value by a cumulative counted value does not exceed a first threshold value.

主权项

1. An apparatus for detecting an in-vehicle network attack under an in-vehicle network environment in which devices having defined priorities for packet transmission are connected to an in-vehicle network bus, the apparatus comprising:
a packet collector configured to collect packets transferred via the in-vehicle network bus; a packet counter configured to cumulatively count the number of packets collected by the packet collector; a check value calculator configured to calculate a check value based on a generation time difference of packets having an identical ID; a cumulated value calculator configured to calculate a cumulated value by summing the check value calculated by the check value calculator and a check value just previously calculated; an average cumulated value calculator configured to calculate an average cumulated value by dividing the cumulated value calculated by the cumulated value calculator by a value cumulatively counted by the packet counter; and an attack determinator configured to determine whether an attack occurs based on the average cumulated value calculated by the average cumulated value calculator.