US 12,353,544 B2
Method for detecting and responding for attack on can network
Dong Hoon Lee, Seoul (KR); and Seyoung Lee, Wonju-si (KR)
Assigned to Korea University Research and Business Foundation, Seoul (KR)
Filed by Korea University Research and Business Foundation, Seoul (KR)
Filed on Nov. 23, 2022, as Appl. No. 17/993,036.
Claims priority of application No. 10-2021-0163927 (KR), filed on Nov. 25, 2021; and application No. 10-2022-0029948 (KR), filed on Mar. 10, 2022.
Prior Publication US 2023/0161878 A1, May 25, 2023
Int. Cl. G06F 21/55 (2013.01); G06F 21/56 (2013.01)
CPC G06F 21/554 (2013.01) [G06F 21/566 (2013.01); G06F 2221/034 (2013.01)] 10 Claims
OG exemplary drawing
 
1. A computer-implemented method for detecting and responding to an attack on a Controller Area Network (CAN), the method comprising:
obtaining a CAN message from a bus of the CAN, the CAN message including a start of frame (SOF) field indicating a start of the CAN message, and an arbitration field connected to the SOF field to identify a priority of the CAN message;
obtaining a first voltage level based on the CAN message;
comparing the first voltage level with a preset normal voltage level; and
determining that there is an attack on the CAN, based on the comparison of the first voltage level with the preset normal voltage level,
wherein the determination includes:
determining that the first voltage level is equal to or higher than the preset normal voltage level;
determining that the arbitration field is over during transmission of the CAN message in response to the first voltage level being equal to or higher than the preset normal voltage level; and
determining that the attack has occurred in a node connected to the CAN bus in response to the determination that that the arbitration field is over.