Detection Method and Mitigation of Server-Spoofing Attacks on SOME/IP at the Service Discovery Phase

Service-oriented architecture has attracted attention in automotive development. The Automotive Open System Architecture (AUTOSAR) specifies Scalable Service-Oriented Middleware over IP (SOME/IP) as a key middleware for service-oriented communication in-vehicles. However, SOME/IP-based networks are vulnerable to server spoofing during the service discovery phase, enabling attackers to cause man-in-the-middle attacks by impersonating legitimate services. This paper proposes a method for detecting attacks in which an attacker spoofs a server during service discovery using a packet switch in a network employing SOME/IP. In addition, a mitigation method is proposed to discard malicious messages. The proposed method addresses the limitations of conventional encryption-based approaches by reducing both processing and communication loads. It also improves anomaly detection rate and detection timing, which have been identified as shortcomings in intrusion detection systems proposed in previous studies. In this study, we evaluated the method using a dataset consisting of 36 attack patterns that combined attack types, attack initiation timing, and message categories. Real-world evaluations demonstrated that the proposed method detected all server spoofing attempts. Further analysis of processing time and memory resource usage confirmed its feasibility for in-vehicle system.