Bit scanner: Anomaly detection for in-vehicle CAN bus using binary sequence whitelisting

Abstract

Due to the vulnerability of in-vehicle networks, particularly the Controller Area Network (CAN), malicious remote intrusion into vehicles has been a prominent public concern in recent years. The majority of existing technologies disregard the importance of the frame payload, making it difficult to detect tampered frames. In this paper, we propose Bit Scanner, a whitelist-based anomaly detection method that employs fine-grained checking for frame payload. Bit Scanner has no dependency on the CAN periodicity or CAN protocol. Its detection capabilities are evaluated using genuine CAN traffic collected from an autonomous bus. The results show that the proposed method has a malicious frames detection rate improvement of about 20% under replay attack scenarios, and a malicious packets detection rate improvement of at least 20% under tampering attack situations compared to the state-of-art methods.