Fuzz Testing and Safe Framework Development for Vehicle Security Analysis

Abstract

As technology advances, mechanical parts of vehicles are being equipped with microcontrollers, including software, and are evolving into ECUs (Electronic Control Unit). These ECUs are interconnected, forming an IVN (In-Vehicle Network), and control a vehicle by communicating control messages to each other. Few control messages are used in IVN communication, but the CAN (Controller Area Network) message is the most used protocol. Autonomous vehicle manufacturers have not developed these control devices and the use of CAN messages because there may be critical vulnerabilities in the vehicles that the manufacturers themselves are not aware of. Among the vulnerability analysis methods, the black-box fuzzing method is the most efficient and common. It finds vulnerabilities by generating random inputs and injecting those inputs into the IVN. However, injecting messages into a real vehicle could have a large impact on the IVN or a system and lead to errors that cannot be fixed. In this work, we created a safe environment for IVN analysis by connecting ECUs used in a real vehicle.