Master Theses

As automotive architectures transition from legacy bus systems to high-speed Automotive Ethernet, the Audio Video Transport Protocol (AVTP) has become the standard for transporting time-sensitive data, including ADAS camera feeds, infotainment streams, and critical control traffic. However, this transition opens new attack vectors: malicious frames can be injected to freeze the camera or spoof control messages within the AVTP stream, potentially leading to catastrophic failures.

The current detection methods exploit the consistency of the Ethernet Frame header. They can detect malicious packets with abnormal sequence numbers in their headers. However, if the anomalies happen before the Ethernet transaction (on the broadcaster or in the real world) or the intrusion is well designed to have a normal header, the current detection systems are at a loss.

To address this scenario, we want to develop an unsupervised Anomaly Detection System to detect abnormal behavior in AVTP packets. More specifically, we want to detect deviations across several consecutive image frames to assess the normality of each image at the packet level. The idea is that the Ethernet packets are supposed to contain the data in the same manner. For example, the first packet should always contain the first chunk of the Intra Frames. So the image to compare the content is equivalent to comparing a small part of the image.

Our research targets three different circumstances:

• An anomaly in the real world, e.g., a damaged camera or obstacles in front of the camera.
• Intrusion on the broadcast, memory replacement, leading to a sequence of AVTP frames with normal headers.

• Injection during transmission. The malicious attacker sends replayed frames with abnormal headers.

Since the AVTP protocol is commonly used to transmit video footage, we can transfer the concept of Abrupt Detection of Image into our system.

The work can be separated into the following parts.

• Literature review for image cut detection (feature extraction)
• Implement a lightweight, unsupervised anomaly detection system for the image sequence.
• Transfer it to the AVTP Ethernet Frames
• If possible, expand the model to the general Ethernet protocols.

Prerequisites

About the Project
Modern vehicles rely on complex distributed systems and generate extensive runtime data from ECUs and in-vehicle networks. These data streams must be analyzed effectively to detect sporadic anomalies. The Diagnosis Unit (DU) currently has no integration with the cloud, which limits the possibility of remote configuration and coordination of local DU during runtime. In highly automated vehicles, real-time anomaly diagnosis is essential for safety, reliability, and early intervention. The current Diagnosis Unit (DU) architecture detects anomalies via Ethernet snooping and trace monitoring but lacks embedded intelligence to autonomously categorize anomalies.

Project Description
This thesis aims to bridge that gap by developing and deploying a lightweight Machine Learning classifier capable of locally identifying the type of anomaly based on metadata (e.g., message rates, ID sequences) and trace-level indicators (e.g., control flow deviations, instruction durations, executed functions). The classifier must be tailored for low-power, runtime embedded systems like the ZCU102 board, ensuring it meets latency, memory, and CPU constraints.

The key tasks for this internship include:

• Build an anomaly classification dataset using real and synthetic traces. 
• Design a minimal-overhead classifier suitable for embedded edge platforms. 
• Compare classification techniques (e.g., decision trees, TinyML NNs, rule-based logic). 
• Optimize the model for execution speed and memory footprint. 
• Integrate and validate the classifier within the DU software stack. 
• Quantitatively evaluate accuracy, timing, and resource utilization under realistic conditions

Key Responsibilities: 

•  Dataset Generation: Create labeled datasets using synthetic trace injections and logged anomaly traces from Aurix boards. 
• Model Development: ? Design candidate classifiers using scikit-learn and/or TensorFlow Lite for Microcontrollers. ? Evaluate trade-offs: accuracy vs. latency vs. Footprint.
• Embedded Integration: ? Port the final model to C/C++ for execution on the DU Processing System (Linux). ? Interface classifier with DU anomaly metadata and trace analyzer. 
• Evaluation: ? Test classifier on live or replayed data. ? Measure detection latency, false positives/negatives, inference time, and CPU/RAM usage. 
• Reporting & Documentation: ? Document training pipeline, performance evaluation, and embedded integration. ? Prepare thesis manuscript and possibly a conference/poster paper.

Prerequisites