Abstract: Disclosed is a method and apparatus for detecting anomalies in a system log on the basis of self-supervised learning, using a language model. The method comprises performing preprocessing on the system log, generating a normal token sequence having a preset length by concatenating tokenized log lines of the system log, generating an abnormal token sequence using the normal token sequence, calculating an anomaly score for a determination target token sequence using a sentence classification model, and determining the token sequence as an abnormal system log when the calculated anomaly score is greater than a threshold value.

Abstract: Disclosed are an apparatus and method for constructing an intrusion detection system applied to CAN communication. The method for constructing an intrusion detection system applied to CAN communication may include extracting standard information by parsing an input file associated with CAN communication, setting a policy rule by applying at least one of a static ruleset and a custom ruleset using the extracted standard information, and creating a policy file to be applied to the intrusion detection system by packing the standard information and the policy rule.

Abstract: A message hop-based communication method of guaranteeing real-time communication in a vehicle communication environment may comprise: receiving, by a first on-board unit (OBU) of a first vehicle, a first message including a message frame (MF) for probe vehicle data (PVD) from a road side unit (RSU); and transmitting a second message, including an MF for a basic safety message (BSM), to a second OBU of a second vehicle, the second message corresponding to the first message, wherein the PVD and the BSM each comprise a data frame for a hopping request.

Abstract: A vehicle-to-everything (V2X) communication-based electronic toll collection system (ETCS) according to an embodiment of the present invention includes at least one roadside unit (RSU), a token issuer checking a de-identified token of a vehicle by communicating with an on-board unit (OBU) of the vehicle via the at least one roadside unit, and a clearing house communicating with the token issuer and charging a toll to a driver/owner of the vehicle. The token issuer generates toll information of the vehicle based on the de-identified token of the vehicle and location information of the at least one roadside unit involved in checking the de-identified token.

Abstract: A device for secure and automated enrollment-certificate bootstrapping on keys and certificates for a vehicle to everything (V2X) environment of a V2X end entity in a security credential management system (SCMS) for V2X communication, the device comprising: a processor; and a memory configured to store at least one instruction to be performed by the processor, the at least one instruction is configured to instruct the processor to perform steps of: by a secure bootstrapping service (SBS) agent, checking, for an SSB server, configuration information; by the SBS agent, making a request for bootstrapping data to the SBS server; and by the SBS agent, installing the bootstrapping data in the SBS server.

Abstract: Provided are a driving negotiation method and apparatus for supporting stability against a blind spot, an unexpected situation, etc. and a rapid judgment and response of an autonomous vehicle in various driving environments. The driving negotiation apparatus includes a wireless communication module configured to support vehicle to everything (V2X) communication and at least one processor connected to the wireless communication module. The at least one processor receives a cooperative request message from a first vehicle, broadcasts a cooperative request message and additional information required for a negotiation to surrounding vehicles, receives a cooperative response message from at least one second vehicle among the surrounding vehicles, and transmits a message indicating that the negotiation is possible or impossible to the first vehicle on the basis of the cooperative response message.

Abstract: A method of detecting an anomaly of a road side unit, which is performed by an anomaly detecting apparatus interworking with one or more road side units, may comprise: receiving traffic data from each of the one or more road side units; performing grouping on the one or more road side units based on the traffic data; generating input data of an artificial neural network based on a result of the performing of the grouping; generating output data of the artificial neural network based on the input data; and detecting an anomaly of each of the one or more road side units based on the output data.

Abstract: Provided is a method for detecting a driver's abnormalities based on a CAN (Controller Area Network) bus network communicating with an ECU (Electronic Control Unit) of a vehicle. The method may include: acquiring a CAN bus signal related to an operation of the vehicle from the CAN bus network; extracting a detection vector from the CAN bus signal using an auto encoder; and detecting a driver's abnormality based on the detection vector.

Abstract: A pseudonym certificate management method, performed by a pseudonym certificate management apparatus interworking with an external server, may comprise: receiving, from the external server, a pseudonym certificate in a state locked based on a root value identifiable only by the external server; periodically receiving an unlocking key for the pseudonym certificate from the external server; activating the pseudonym certificate with the unlocking key; and when the activated pseudonym certificate is abnormal, deactivating the pseudonym certificate.

Abstract: An operation method of a communication node in a communication network may comprise receiving CAN signals from a plurality of CAN communication nodes; generating forward input data by performing forward preprocessing on the received CAN signals based on forward sampling times; generating forward mask data for the forward input data and forward time interval data according to the forward sampling times; generating backward input data by performing backward preprocessing on the CAN signals based on backward sampling times; generating backward mask data for the backward input data and backward time interval data according to the backward sampling times; and detecting an abnormal signal among the CAN signals by inputting the forward input data, forward mask data, forward time interval data, backward input data, backward mask data, and backward time interval data into a gated recurrent unit-decay (GRU-D) neural network.

Abstract: Provided is a method of machine learning for a convolutional neural network (CNN). The method includes: receiving input target data; determining whether to initiate incremental learning on the basis of a difference between a statistical characteristic of the target data with respect to the CNN and a statistical characteristic of previously used training data with respect to the CNN; determining a set of kernels with a high degree of mutual similarity in each convolution layer included in the CNN when the incremental learning is determined to be initiated; and updating a weight between nodes to which kernels included in the set of kernels with a high degree of mutual similarity are applied.