Techniques for misbehavior detection in wireless communications systems

Patent metadata

Field	Value
Publication number	US-12309593-B2
Application number	US-202117484806-A
Country	US
Kind code	B2
Filing date	Sep 24, 2021
Priority date	Sep 24, 2021
Publication date	May 20, 2025
Grant date	May 20, 2025

Abstract

Methods, systems, and devices for wireless communications are described. A communication device may detect vehicle-to-everything (V 2 X) fuzzing attacks. The communication device may receive a set of packets. Each packet of the set of packets includes a set of information element (IE) fields. The communication device determine a change to one or more IE fields of the set of IE fields and associated with at least a subset of packets of the set of packets based on comparing a respective value associated with each of the one or more IE fields to a respective default value associated with each of the one or more IE fields. As a result, the communication device may transmit a report indicating a plurality of fuzzing attacks at the communication device.

First claim

What is claimed is:

1. A method for wireless communication at a device, comprising:
receiving a set of vehicle-to-everything (V2X) messages during a time window for detection of fuzzing attacks, each V2X message of the set of V2X messages comprising a set of information element fields associated with V2X operations of a second device in accordance with the device operating within a V2X communications system;
determining a change to one or more information element fields of the set of information element fields in multiple V2X messages of the set of V2X messages received in the time window based at least in part on a comparison of a respective value associated with each of the one or more information element fields to a respective expected value associated with each of the one or more information element fields, each V2X message of the multiple V2X messages comprising a same identifier associated with the second device and comprising a respective basic safety message associated with the V2X operations of the second device;
detecting a fuzzing attack associated with the multiple V2X messages of the set of V2X messages received in the time window based at least in part on determining the change; and
transmitting, to a network entity, a single report indicating the fuzzing attack and including evidence of the fuzzing attack aggregated from the multiple V2X messages based at least in part on determining the change and based at least in part on the multiple V2X messages comprising the same identifier.

2. The method of claim 1 , wherein determining the change to the one or more information element fields of the set of information element fields comprises:
determining whether a value of each of the one or more information element fields of the multiple V2X messages satisfies a respective threshold value, wherein the respective threshold value comprises the respective expected value associated with each of the one or more information element fields.

3. The method of claim 1 , further comprising:
determining a pattern associated with the fuzzing attack for the multiple V2X messages, the pattern indicating an increase or a decrease in the respective value associated with each of the one or more information element fields, wherein the increase or the decrease in the respective value associated with each of the one or more information element fields is based at least in part on a randomness, the pattern identifying a data type associated with each of the one or more information element fields, wherein determining the change to the one or more information element fields of the set of information element fields is based at least in part on the pattern associated with the fuzzing attack for the multiple V2X messages.

4. The method of claim 1 , wherein determining the change to the one or more information element fields of the set of information element fields is based at least in part on a machine learning algorithm.

5. The method of claim 1 , further comprising:
aggregating evidence of a plurality of misbehaviors based at least in part on determining the change to the one or more information element fields of the set of information element fields, each misbehavior of the plurality of misbehaviors corresponding to an instance of the respective value associated with each of the one or more information element fields differing from the respective expected value associated with each of the one or more information element fields; and
storing the evidence of the plurality of misbehaviors, wherein detecting the fuzzing attack is based at least in part on storing the evidence, and wherein the single report includes the evidence of the plurality of misbehaviors.

6. The method of claim 1 , wherein transmitting the single report indicating the fuzzing attack and including the evidence aggregated from the multiple V2X messages comprises:
transmitting, to the network entity, information associated with the multiple V2X messages based at least in part on determining the change to the one or more information element fields of the set of information element fields, the information indicating a detected misbehavior for each of the multiple V2X messages and a time stamp associated with the detected misbehavior for each of the multiple V2X messages.

7. The method of claim 1 , further comprising:
tracking the same identifier associated with the second device that transmits at the multiple V2X messages based at least in part on determining the change to the one or more information element fields.

8. The method of claim 1 , further comprising:
receiving, from the network entity, feedback information based at least in part on the single report indicating the fuzzing attack; and
monitoring a second set of V2X messages for a second change to a second one or more information element fields of a second set of information element fields in multiple V2X messages of the second set of V2X messages based at least in part on the feedback information.

9. The method of claim 8 , wherein the feedback information comprises an acknowledgement of the single report indicating the fuzzing attack.

10. The method of claim 8 , wherein the feedback information comprises a negative acknowledgement of the single report indicating the fuzzing attack, and wherein the feedback information indicates that the change to the one or more information element fields is associated with a plurality of separate attacks, the method further comprising:
adjusting a detection criteria for fuzzing attacks based at least in part on the feedback information comprising the negative acknowledgement, wherein monitoring the second set of V2X messages for the change to the second one or more information element fields of the second set of information element fields is based at least in part on the adjusting of the detection criteria for fuzzing attacks.

11. The method of claim 1 , wherein the time window for detection of fuzzing attacks comprises a pre-configured time window or a dynamically configured time window.

12. A device for wireless communication, comprising:
one or more memories storing processor-executable code; and
one or more processors coupled with the one or more memories and individually or collectively operable to execute the code to cause the apparatus device to:
receive a set of vehicle-to-everything (V2X) messages during a time window for detection of fuzzing attacks, each V2X message of the set of V2X messages comprising a set of information element fields associated with V2X operations of a second device in accordance with the device operating within a V2X communications system;
determine a change to one or more information element fields of the set of information element fields in multiple V2X messages of the set of V2X messages received in the time window based at least in part on a comparison of a respective value associated with each of the one or more information element fields to a respective expected value associated with each of the one or more information element fields, each V2X message of the multiple V2X messages comprising a same identifier associated with the second device and comprising a respective basic safety message associated with the V2X operations of the second device;
detect a fuzzing attack associated with the multiple V2X messages of the set of V2X messages received in the time window based at least in part on determining the change; and
transmit, to a network entity, a single report indicating the fuzzing attack and including evidence of the fuzzing attack aggregated from the multiple V2X messages based at least in part on determining the change and based at least in part on the multiple V2X messages comp

Assignees

• Qualcomm Inc

Inventors

• Petit Jonathan
• Monteuuis Jean-Philippe
• Ansari Mohammad Raashid
• Chen Cong

Classifications

• H04W12/106

  Packet or message integrity · CPC title

• H04W4/40

  for vehicles, e.g. vehicle-to-pedestrians [V2P] · CPC title

• G06F21/577

  Assessing vulnerabilities and evaluating computer system security · CPC title

• G06F21/554

  involving event detection and direct action · CPC title

• G06F21/552

  involving long-term monitoring or reporting · CPC title