Controller Area Network Research Articles

A novel intrusion detection model for the CAN bus packet of in-vehicle network based on attention mechanism and autoencoder

The attacks on in-vehicle Controller Area Network (CAN) bus messages severely disrupt normal communication between vehicles. Therefore, researches on intrusion detection models for CAN have positive business value for vehicle security, and the intrusion detection technology for CAN bus messages can effectively protect the in-vehicle network from unlawful attacks. Previous machine learning-based models are unable to effectively identify intrusive abnormal messages due to their inherent shortcomings. Hence, to address the shortcomings of the previous machine learning-based intrusion detection technique, we propose a novel method using Attention Mechanism and AutoEncoder for Intrusion Detection (AMAEID). The AMAEID model first converts the raw hexadecimal message data into binary format to obtain better input. Then the AMAEID model encodes and decodes the binary message data using a multi-layer denoising autoencoder model to obtain a hidden feature representation that can represent the potential features behind the message data at a deeper level. Finally, the AMAEID model uses the attention mechanism and the fully connected layer network to infer whether the message is an abnormal message or not. The experimental results with three evaluation metrics on a real in-vehicle CAN bus message dataset outperform some traditional machine learning algorithms, demonstrating the effectiveness of the AMAEID model.

A multi-attack intrusion detection model based on Mosaic coded convolutional neural network and centralized encoding.

With the development of the Internet of Vehicles (IoV), attacks to the vehicle-mounted control area network (CAN) have seriously jeopardized the security of automobiles. As an important security measure, intrusion detection technologies have aroused great interest in researchers and many detection methods have also been proposed based on the vehicle’s CAN bus. However, many studies only considered one type of attack at a time but in real environments there may contain a variety of attack types simultaneously. In view of the deficiency in the current methods, this paper proposed a method to detect multi-intrusions at one time based on a Mosaic coded convolutional neural network (CNN) and a centralized coding method. A Mosaic-like data block was created to convert the one-dimensional CAN ID into a two-dimensional data grid for the CNN to effectively extract the data characteristics and maintain the time characteristics between the CAN IDs. Four types of attacks and all combinations of them were used to train and test our model. Finally, a centralized coding method was used to increase the discrimination capability of the model. Experimental results showed that this single model could successfully detect any combinations of the intrusion types with very high and stable performance.

A Computational Model for Driver Risk Evaluation and Crash Prediction Using Contextual Data from On-board Telematics

Introduction: Vehicle crashes can be hazardous to public safety and may cause infrastructure damage. Risky driving significantly raises the possibility of the occurrence of a vehicle crash. As per statistics by the World Health Organization (WHO), approximately 1.35 million people are involved in road traffic crashes resulting in loss of life or physical disability. WHO attributes events like over-speeding, drunken driving, distracted driving, dilapidated road infrastructure and unsafe practices such as non-use of helmets and seatbelts to road traffic accidents. As these driving events negatively affect driving quality and enhance the risk of a vehicle crash, they are termed as negative driving attributes. Methods: A multi-level hierarchical fuzzy rules-based computational model has been designed to capture risky driving by a driver as a driving risk index. Data from the onboard telematics device and vehicle controller area network is used for capturing the required information in a naturalistic way during actual driving conditions. Fuzzy rules-based aggregation and inference mechanisms have been designed to alert about the possibility of a crash due to the onset of risky driving. Results: On-board telematics data of 3213 sub-trips of 19 drivers has been utilized to learn long term risky driving attributes. Furthermore, the current trip assessment of these drivers demonstrates the efficacy of the proposed model in correctly modeling the driving risk index of all of them, including 7 drivers who were involved in a crash after the monitored trip. Conclusions: In this work, risky driving behavior has been associated not just with rash driving but also other contextual data like driver’s long-term risk aptitude and environmental context such as type of roads, traffic volume and weather conditions. Trip-wise risky driving behavior of six out of seven drivers, who had met with a crash during that trip, was correctly predicted during evaluation. Similarly, for the other 12 drivers, the model accurately predicted safe driving behavior as these drivers did not meet with any vehicle crash. The proposed model can be used as an alert mechanism to indicate potential crash scenarios to the driver. The current study did not study lane changing behavior in detail due to difficulty in capturing road lanes in the Indian context.

Research on Fault Diagnosis of PST Electro-Hydraulic Control System of Heavy Tractor Based on Support Vector Machine

Due to the harsh working environment of the tractor, the transmission can often be faulty. In order to ensure the reliability of its operation, it must be monitored and the fault discovered. In this paper, the support vector machine (SVM) method is used. The eigenvector conversion of the original data uses the following eigenvectors: Three fault modes (leakage fault of shift clutch hydraulic cylinder, blockage fault of oil passage, and blockage fault of proportional valve spool) are identified in matrix and laboratory (MATLAB) with the help of the library for support vector machines (LibSVM) toolkit, and the classification accuracy of test samples is 90%. The normal mode of the PST electro-hydraulic system and the three kinds of fault modes mentioned above are discriminated against, and the correct rate of fault diagnosis reaches 95%, which meets the needs of practical engineering. Analysis of the fault recording data of the power shifting transmission shift solenoid valve shows that the difference between fault pressure data and normal data is small, and the value of traffic data is greater. This method can realize the fault mode online recognition based on controller area network (CAN) communication, and the research results provide a theoretical basis for the fault diagnosis of the PST electro-hydraulic control system.

Enhanced Map-Aided GPS/3D RISS Combined Positioning Strategy in Urban Canyons

To realize the effective positioning in urban canyons, an enhanced map-aided Global Positioning System (GPS)/three-dimensional (3D) reduced inertial sensor system (RISS) tightly combined positioning strategy is proposed. First, the 3D RISS is only based on the built-in controller area network (CAN). CAN bus sensor without additional sensors is first constructed to lower the cost. Then, a simple but effective enhanced map is created to assist positioning. Based on the map, a Kalman filtering (KF) tightly coupled method is proposed to fuse the 3D RISS with GPS information and to achieve the preliminary positioning. In KF-based preliminary positioning method, a simply observation noise variance optimization algorithm based on 2D enhanced map is proposed to improve KF method. In this algorithm, the value of the observation noise variance matrix is determined only according to the building plane information which is contained in the enhanced map. Further, a multiweight map matching algorithm is proposed for optimizing the initial positioning results. In this algorithm, factors such as distance, direction, road network topology, and lane change are considered and applied to map matching to further increase the positioning performance and form the final positioning results. Finally, the effectiveness of the strategy is proved by field test. The results show that this method has better accuracy and reliability than the conventional method.

The Development of an Electric-Driven Control System for a High-Speed Precision Planter Based on the Double Closed-Loop Fuzzy PID Algorithm

In order to solve the problems of traditional seeders, such as low seeding efficiency, tangled straw, a large amount of clay, easy ridge breakage in sowing operations, low qualified rate of high-speed seeding, and poor uniformity, this paper takes the pneumatic corn planter as the research object, the Beidou automatic driving unit as the carrier, the CAN (Controller Area Network) bus as the communication medium, and the double closed-loop fuzzy PID (proportion-integral-derivative) algorithm as the control core and designs a high-speed precision corn seeding control system based on Beidou navigation. It solves the problems that exist in traditional planters. In the bench experiment, the stability of the system is judged by comparing the motor control accuracy with ordinary PID and measuring the motor response time of the system at different speeds. The bench test results show that when the theoretical seeding speed is 0~34 r·min−1, the response time of the motor is shortened by 0.51 s compared with the ordinary PID control, and the error between the actual speed and the target value is less than 0.35%. The field experiment results show that when the unit runs for 5~13 km·h−1, the qualified rate of average planting spacing is greater than 95.81%, the reseeding rate is less than 10.11%, and the coefficient of variation is less than 16.72%, which complies with the standard of a corn sowing operation.

IoT-Based Response Time Analysis of Messages for Smart Autonomous Collision Avoidance System Using Controller Area Network

Many accidents and serious problems occur on the road due to the rapid increase in traffic congestion in all sections of the country. Autonomous vehicles provide a solution to successfully and cost-effectively avoid this problem while minimizing user disruption. Currently, more engaging electromechanical elements with an analog interface are used to develop affordable automobiles for efficient and cost-effective operation for a smart driving platform with a semiautonomous automobile, strengthening the vehicle involvement of the driver while increasing safety. As a result, it takes longer for various car elements to respond, which causes more problems during message transmission. This project aims to create a Controller Area Network (CAN) for analyzing message response times by incorporating a few application nodes on the IoT platform, such as an antilock braking system, flexible cruise control, and seat belt section, for some real-time control system applications. These application nodes are car analytical parts that are linked to IoT modules to prevent collisions. An autonomous device for collision avoidance and obstacle detection in a vehicle can impact road accidents if the CAN protocol is implemented.

MGA-IDS: Optimal feature subset selection for anomaly detection framework on in-vehicle networks-CAN bus based on genetic algorithm and intrusion detection approach

Controller area network (CAN) bus which provides efficient, reliable and robust communication between electronic control units (ECUs) is the most frequently used protocol for in-vehicle networks. However, the lack of security mechanisms in the CAN protocol makes it vulnerable to inside and outside cyber-attacks. Therefore, an intrusion detection system (IDS), which is a widely used method to detect malicious activities, is preferred to improve the security of the CAN buses. In spite of the fact that various supervised and unsupervised machine learning algorithms are employed to increase the performance of IDSs, obtaining high classification performance is still a challenge for them. First, a lot of irrelevant and redundant features in the datasets result in long computational times with low detection performances. Second, different classification performances are acquired based on classifiers and a combination of the features. Third, many of the models suffer from unknown and different types of attacks. For these reasons, a new intrusion detection framework is proposed in this paper based on feature selection and classifier. Initially, we propose a meta-heuristic algorithm called modified genetic algorithm (MGA) m-feature selection for dimension reduction by selecting optimal feature subset based on k-fold cross validation. Then, we utilize five different linear and nonlinear classifiers: support vector classifier (SVC), logistic regression classifier (LRC), decision tree classifier (DTC), k-nearest neighbors classifier (KNC), and linear discriminant analysis classifier (LDAC) as candidate classifiers to develop an efficient IDS. Finally, we select the best classifier from the candidates and build an IDS. The experimental results reveal that the proposed MGA-DTC presents a better performance in terms of several metrics based on not only the HCRL-car hacking dataset but also UNSW-NB15, and CIC-IDS2017 datasets.

CAN Bus Message Authentication via Co-Channel RF Watermark

Over the past decade, consumer vehicles have increasingly begun to resemble computers on wheels, with many newer vehicles containing over 100 independent electronic control units (ECU) that make independent decisions within the vehicle. Cost and power constraints for the vehicle significantly constrain processing capabilities and limitations on practical cybersecurity measures that may be employed in the vehicle today. Also, as automotive manufacturers are continuous integrators, many legacy communications links within vehicles were originally designed as standalone entities that assumed internal trust of communications between ECUs by virtue of closed bus structures and an emphasis on reliability, but not security. This paper presents a low-cost authentication mechanism to significantly improve message validation on wired message buses such as the Controller Area Network (CAN) bus by employing a co-channel underlay watermark that arrives time-aligned with the primary bus messages. Concept validation using a gate-level Simulink / HDL Coder simulation provided initial feasibility, while a complete CAN bus hardware testbed was constructed with a custom CAN transceiver built on a Red Pitaya software defined radio (SDR) connected to multiple commercial CAN transceivers to validate backwards compatibility. This testbed incorporates a custom transmission security (TRANSEC) engine that supports dynamic variation of the watermark, further improving security during deployment. Finally, this custom CAN testbed with the watermarking CAN transceiver was tested across a range of operational conditions, with initial performance results presented and discussed. Future work describes potential for near-term ruggedization and productization of the watermarking CAN transceiver.

Hybrid Quantum-Classical Neural Network for Cloud-Supported In-Vehicle Cyberattack Detection

A classical computer works with ones and zeros, whereas a quantum computer uses ones, zeros, and superpositions of ones and zeros, which enables quantum computers to perform a vast number of calculations simultaneously compared to classical computers. In a cloud-supported cyber−physical system environment, running a machine learning application in quantum computers is often difficult, due to the existing limitations of the current quantum devices. However, with the combination of quantum-classical neural networks (NN), complex and high-dimensional features can be extracted by the classical NN to a reduced but more informative feature space to be processed by the existing quantum computers. In this study, we developed a hybrid quantum-classical NN to detect an amplitude shift cyberattack on an in-vehicle controller area network dataset. We showed that by using the hybrid quantum-classical NN, it is possible to achieve an attack detection accuracy of 94%, which is higher than a long short-term memory NN (88%) or quantum NN alone (62%).

An Intelligent Data-Driven Model to Secure Intra- Vehicle Communications based on Machine Learning

Abstract: The depend on electric vehicles on either in vehicle or between-vehicle communications can cause big issues in the system. The model is constructed based on an better support vector machine model for difference finding based on the controller area network (CAN) bus protocol. In order to improve the capabilities of the model for fast mischievous attack detection and avoidance, a new optimization algorithm based on social spider (SSO) algorithm is developed which will emphasize the training process at. The model results on the real data sets tell the high performance, consistency hacking in the electric vehicles. Keywords: Electric Vehicle, Intra-Vehicle, Controller-AreaNetworks (CAN Bus), Anomaly Detection, Optimiz.

A hybrid deep learning based intrusion detection system using spatial-temporal representation of in-vehicle network traffic

A significant increase in the use of electronics control units (ECUs) in modern vehicles has made controller area network (CAN) a de facto standard in the automotive industry. CAN standard has been designed as a reliable and straightforward broadcast-based protocol for providing serial communication between ECUs without considering security aspects like authentication and encryption. Cyber attackers have exploited these vulnerabilities to mount a variety of attacks against CAN-based in-vehicle network. In this work, we proposed a hybrid deep learning-based intrusion detection system (HyDL-IDS) based upon spatial-temporal representation for characterizing in-vehicle network traffic accurately. For this purpose, we use convolutional neural network (CNN) and long short term memory (LSTM) in sequence for extracting spatial and temporal features automatically from in-vehicle network traffic. The proposed HyDL-IDS have been validated using a benchmark car-hacking data set. The reported results demonstrate approximately 100% detection accuracy with a low false alarm rate for different cyber-attacks, including denial-of-service (DoS) attacks, fuzzy attacks and spoofing (Gear and revolutions per minute (RPM)) attacks based on the identified dataset. The HyDL-IDS have significantly improved detection accuracy and false alarm rate for detecting intrusions in-vehicle network compared to other methods, namely Naive Bayes, Decision tree, Multi-layer perceptron, CNN, and LSTM based on spatial-temporal representation of in-vehicle network traffic.

CANon: Lightweight and Practical Cyber-Attack Detection for Automotive Controller Area Networks.

Automotive cyber-physical systems are in transition from the closed-systems to open-networking systems. As a result, in-vehicle networks such as the controller area network (CAN) have become essential to connect to inter-vehicle networks through the various rich interfaces. Newly exposed security concerns derived from this requirement may cause in-vehicle networks to pose threats to automotive security and driver’s safety. In this paper, to ensure a high level of security of the in-vehicle network for automotive CPS, we propose a novel lightweight and practical cyber defense platform, referred to as CANon (CAN with origin authentication and non-repudiation), to be enabled to detect cyber-attacks in real-time. CANon is designed based on the hierarchical approach of centralized-session management and distributed-origin authentication. In the former, a gateway node manages each initialization vector and session of origin-centric groups consisting of two more sending and receiving nodes. In the latter, the receiving nodes belonging to the given origin-centric group individually perform the symmetric key-based detection against cyber-attacks by verifying each message received from the sending node, namely origin authentication, in real-time. To improve the control security, CANon employs a one-time local key selected from a sequential hash chain (SHC) for authentication of an origin node in a distributed mode and exploits the iterative hash operations with randomness. Since the SHC can constantly generate and consume hash values regardless of their memory capacities, it is very effective for resource-limited nodes for in-vehicle networks. In addition, through implicit key synchronization within a given group, CANon addresses the challenges of a key exposure problem and a complex key distribution mechanism when performing symmetric key-based authentication. To achieve lightweight cyber-attack detection without imposing an additive load on CAN, CANon uses a keyed-message authentication code (KMAC) activated within a given group. The detection performance of CANon is evaluated under an actual node of Freescale S12XF and virtual nodes operating on the well-known CANoe tool. It is seen that the detection rate of CANon against brute-force and replay attacks reaches 100% when the length of KMAC is over 16 bits. It demonstrates that CANon ensures high security and is sufficient to operate in real-time even on low-performance ECUs. Moreover, CANon based on several software modules operates without an additive hardware security module at an upper layer of the CAN protocol and can be directly ported to CAN-FD (CAN with Flexible Data rate) so that it achieves the practical cyber defense platform.

Accelerating In-Vehicle Network Intrusion Detection System Using Binarized Neural Network

<div class="section abstract"><div class="htmlview paragraph">Controller Area Network (CAN), the de facto standard for in-vehicle networks, has insufficient security features and thus is inherently vulnerable to various attacks. To protect CAN bus from attacks, intrusion detection systems (IDSs) based on advanced deep learning methods, such as Convolutional Neural Network (CNN) and Recurrent Neural Network (RNN), have been proposed to detect intrusions. However, those models generally introduce high latency, require considerable memory space, and often result in high energy consumption. To accelerate intrusion detection and also reduce memory requests, we exploit the use of Binarized Neural Network (BNN) and hardware-based acceleration for intrusion detection in in-vehicle networks. As BNN uses binary values for activations and weights rather than full precision values, it usually results in faster computation, smaller memory cost, and lower energy consumption than full precision models. Moreover, unlike other deep learning methods, BNN can be further accelerated by leveraging Field-Programmable Grid Arrays (FPGAs) since BNN cuts down the hardware consumption. We design our BNN model to suit CAN traffic data and exploit sequential features of the CAN traffic instead of individual messages. We evaluate the proposed IDS with four different real vehicle datasets. Our experimental results show that the proposed BNN-based IDS reduces the detection latency on the same CPU (3 times faster) while maintaining acceptable detection rates compared to full precision models. We also implement the proposed IDS using FPGA hardware to reduce latency further and accelerate intrusion detection. Our experiments on multiple platforms demonstrate that using the FPGAs dramatically reduces the detection latency (128 times faster) with lower power consumption in comparison with an embedded CPU.</div></div>

Rec-CNN: In-vehicle networks intrusion detection using convolutional neural networks trained on recurrence plots

A controller area network (CAN) is a communication protocol for in-vehicle networks. Communication between electronic control units (ECUs) is facilitated by the CAN bus. This communication protocol provides no authentication or encryption to prevent the consequences of cyberattacks. As a security measure for this protocol, we have proposed an intrusion detection system (IDS) using a convolutional neural network (CNN). The CNN is trained on recurrence images generated from the encoded labels of CAN frame arbitration IDs, thus Rec-CNN. Using recurrence plots helps us capture the temporal dependency in the sequence of arbitration IDs unlike the state-of-art method, which does not capture this information. We have tested the proposed method on a publicly available dataset with denial of service (DoS), fuzzy, spoofing-gear, and spoofing-RPM attacks, resulting in an accuracy of 0.999. Furthermore, we have experimented with the method on our target vehicle. The proposed method can classify our simulated attacks with an accuracy of 0.999 in an attack frequency of 10 ms.

Two-Layer Bus-Independent Instruction Set Architecture for Securing Long Protocol Data Units in Automotive Open System Architecture-Based Automotive Electronic Control Units

In this paper, we propose a bus-independent hardware (HW)-based approach to secure long protocol data units (PDUs) in Automotive Open System Architecture (AUTOSAR)-based automotive electronic control units (ECUs). Our approach is based on extending previous works that implemented two AUTOSAR communication (COM) application-specific instruction set processors (ASIPs). COM ASIP V1 introduced two instructions to handle the transmission and reception of PDUs no larger than 8 bytes and signals no larger than 32 bits individually through send signal and receive signal instructions. COM ASIP V2 introduced two extra instructions to handle long signals and PDUs of arbitrary lengths. We extended the instruction set architecture (ISA) of our previous ASIPs by introducing six new instructions, in COM ASIP V3, to hash PDUs that contain these signals to authenticate transmission and reception of such PDUs. The experimental results show that COM ASIP V3 can handle (i.e., transmit, receive, calculate hash, or verify hash) a 64-byte controller area network flexible data-rate (CAN FD) frame in 1.575 μs and a 254-byte FlexRay frame in 6.301 μs. These measurements indicate that the throughput of our new COM ASIP is much higher, 42× to 75×, than the throughput required by these communication buses.

Intrusion Detection Method for In-Vehicle CAN Bus Based on Message and Time Transfer Matrix

As the number and computational power of electronic computing units installed in standard automobiles continue to increase, contemporary motor vehicles face more cybersecurity threats than previous designs, while providing greater convenience and various useful features. Although vehicles are attacked at various entry points, eventually, attacks are injected into the in-vehicle controller area network (CAN) to cause vehicle anomalies. Currently, OEMs and research fields have implemented protection for the CAN bus in terms of external interfaces, internal protocols, and intrusion detection. Although the deployment of intrusion detection solutions is the most effective approach, the main challenges currently faced by automobile intrusion detection algorithms in practice involve limited computing resources, insufficient real-time responsiveness, and low recognition accuracy. In this study, we propose a novel intrusion detection method based on the message and time transfer matrix to address these difficulties, which can be applied to the vehicle Electronic Control Unit (ECU) to achieve real-time attack signal identification with high accuracy. Experiments on actual vehicles show that the proposed algorithm identified various attacks with high accuracy while consuming less computational and storage resources than previous methods. Moreover, the efficiency of the proposed algorithm is not affected by the attack injection frequency. Compared with other methods, the proposed method achieved better attack identification performance. Additionally, the message and time transfer matrix used by the algorithm can be used as a message transfer fingerprint of the CAN bus to discover anomalies.

Feature Selection for Supervised Learning and Compression

ABSTRACT Supervised feature selection aims to find the signals that best predict a target variable. Typical approaches use measures of correlation or similarity, as seen in filter methods, or predictive power in learned models, as seen in wrapper methods. In both approaches, the selected features often have high entropies and are not suitable for compression. This is a particular drawback in the automotive domain where fast communication and archival of vehicle telemetry data is increasingly important, especially with technologies such as V2V and V2X (vehicle-to-vehicle and vehicle-to-everything communication). This paper aims to select features with good predictive performances and good compression by introducing a compressibility factor into several existing feature selection approaches. Where appropriate, performance guarantees are provided for greedy searches based on monotonicity and submodularity. Using the language of entropy, the relationship between relevance, redundancy, and compressibility is discussed from the perspective of signal selection. The approaches are then demonstrated in selecting features from a vehicle Controller Area Network for use in SVMs in a regression task, namely predicting fuel consumption, and a classification task, namely identifying Points of Interest. We show that while predictive performance is slightly lower when compression is considered, the compressibility of the selected features is significantly improved.

CAN Bus Messages Abnormal Detection Using Improved SVDD in Internet of Vehicles

Controller Area Network (CAN) bus anomaly detection on the Internet of Vehicle (IoV) is a topic of ongoing interest and increasing importance, particularly as IoV becomes commonplace. However, existing abnormal detection schemes are not ideal due to the lack of abnormal data in IoV and the difficulty of parsing the diverse message rules in existing vehicles. While single-classification of the SVDD (Support Vector Domain Description) algorithm can detect abnormalities only with normal message information, the approach has a high rate of false negatives when deployed directly in the in-vehicle network environment. In addition, the real-time data generation (e.g., IoV messages) compounds the challenge of designing effective detection approaches. Therefore, this paper proposes a mechanism for car networking message classification for a broad range of data, and establishes a weak model for many simple redundant data in the vehicle intranet. The detection can reduce the time and computation costs of detection while ensuring accuracy. Then, this paper proposes two improved SVDD schemes: M-SVDD scheme which adds the Markov chain to detect time-related messages; G-SVDD scheme which maps the kernel function to the Gaussian kernel function to reduce the redundant area of the model and the false-negative rate. The experimental results show that our proposed schemes have higher accuracy, recall rate and fewer computation overhead.

Implementation of UAV Smooth Path Planning by Improved Parallel Genetic Algorithm on Controller Area Network

Implementation of UAV Smooth Path Planning by Improved Parallel Genetic Algorithm on Controller Area Network