Intrusion Detection Systems (IDS)

#!/usr/bin/env python3
# Ethernet IDS: SOME/IP + DoIP inspection rules
# Deployed as passive tap on automotive Ethernet switch span port

import struct

def inspect_uds_over_doip(payload: bytes) -> dict:
    # Signature-based rule: detect UDS DID enumeration (reconnaissance)
    if len(payload) < 4: return {"alert": False}
    service_id = payload[0]
    if service_id != 0x22: return {"alert": False}

    # UDS 0x22 ReadDataByIdentifier: inspect DID
    did = struct.unpack(">H", payload[1:3])[0]
    return {
        "alert":    True,
        "event":    "IDS_EVENT_UDS_DID_ENUM",
        "did":      hex(did),
        "severity": "MEDIUM",
        "note":     "Systematic DID enumeration indicates reconnaissance"
                    if did == 0x0000 else "Normal ReadDataByIdentifier",
    }

def inspect_someip_anomaly(src_ecu_id: int, service_id: int,
                            method_id: int, baseline: dict) -> dict:
    # Anomaly-based: flag SOME/IP call patterns deviating > 3 sigma from baseline
    key = f"{src_ecu_id}:{service_id}:{method_id}"
    if key not in baseline: return {"alert": False}

    mean, stddev = baseline[key]["mean"], baseline[key]["std"]
    # Baseline call rate checked against recent 5-minute window
    return {
        "alert":    False,  # placeholder: would compare recent_rate vs mean+3*std
        "event":    "IDS_EVENT_SOMEIP_ANOMALY",
        "key":      key,
        "severity": "LOW",
    }