Anomaly Detection in Vehicular CAN Bus Using Message Identifier Sequences

Tahsin C M Donmez

doi:10.1109/access.2021.3117038

Abstract

As the automotive industry moves forward, security of vehicular networks becomes increasingly important. Controller area network (CAN bus) remains as one of the most widely-used protocols for in-vehicle communication. In this work, we study an intrusion detection system (IDS) which detects anomalies in vehicular CAN bus traffic by analyzing message identifier sequences. We collected CAN bus data from a heavy-duty truck over a period of several months. First, we identify the properties of CAN bus traffic which enable the described approach, and demonstrate that they hold in different datasets collected from different vehicles. Then, we perform an experimental study of the IDS, using the collected CAN bus data and procedurally generated attacks. We analyze the performance of the IDS, considering various attack types and hyperparameter values. The analysis yields promising sensitivity and specificity values, as well as very fast decision times and acceptable memory footprint.

Highlights

Automotive industry is moving in a direction where connectedness and autonomy become essential features of vehicles
BACKGROUND we provide background information about CAN bus and security aspects of its usage in in-vehicle communication, as well as intrusion detection systems, and their application to vehicular CAN bus
DESCRIPTION OF THE STUDIED IDS The intrusion detection system we study in this paper is a generalization of the intrusion detection system proposed in [27]

Summary

Introduction

Automotive industry is moving in a direction where connectedness and autonomy become essential features of vehicles. Cui et al [1], Thing et al [2], and Yagdereli et al [3] provide an overview of cyber-security aspect of connected and autonomous vehicles, including classification of applicable cyber-attacks and corresponding countermeasures. A. CONTROLLER AREA NETWORK Controller Area Network (CAN bus) was originally developed for interconnecting electronic control units (ECU) within automobiles, and the first version of the protocol was published in 1986 [6]. CONTROLLER AREA NETWORK Controller Area Network (CAN bus) was originally developed for interconnecting electronic control units (ECU) within automobiles, and the first version of the protocol was published in 1986 [6] Today, it is a widely adopted technology for in-vehicle communication, and it has applications in other contexts. CAN bus features a cyclic redundancy check (CRC) against nonmalicious bit errors

Methods

Results

Conclusion