In-vehicle CAN Research Articles

Study on In-Vehicle CAN dynamic Service Platform Based on Universal Middleware

Study on In-Vehicle CAN dynamic Service Platform Based on Universal Middleware

A Two-Layer Dynamic ECU Group Management Scheme for In-Vehicle CAN Bus

A Two-Layer Dynamic ECU Group Management Scheme for In-Vehicle CAN Bus

Blockchain integration for in-vehicle CAN bus intrusion detection systems with ISO/SAE 21434 compliant reporting.

The development of Intrusion Detection Systems (IDS) for in-vehicle buses has gained a lot of momentum in recent years as the number of reported vulnerabilities and the degree of interconnectivity for modern vehicles are on the rise. Since intrusion detection is resource consuming, it can be performed on computationally capable Android head units that are now present inside vehicles. Moreover, these units are connected to the internet, which enables the use of more complex algorithms that run in cloud environments. In this work we develop one such approach: an IDS that consists of a locally installed copy, running on head units, and a centralized instance of it that runs in the cloud and monitors traffic for groups of similar vehicles. Additionally, the centralized instance is part of a cloud service for intrusion detection which is continuously updated with the most recent types of attacks. The classification results of the cloud-based service are further analyzed by an incident response team which confirms the presence of known attacks, analyzes new types of attacks and assesses their impact. The output of this activity is stored on the Blockchain as ISO/SAE 21434 compliant reports, ensuring the transparency and traceability of the reported incidents.

Detecting CAN overlapped voltage attacks with an improved voltage-based in-vehicle intrusion detection system

The in-vehicle voltage-based intrusion detection system (VIDS) can recognize the identity of the ECUs and detect the physical layer attacks that cannot be detected by the content-based or frequency-based IDS. However, recent research in VIDS has discovered an overlapped voltage attack that can bypass the existing VIDS by generating overlapped voltage signals from two compromised ECUs to distort the fingerprint of the target ECU. The existing solutions need to change the communication protocol or network topology to mitigate the attack, which may involve additional development costs or scheduling mechanisms to coordinate the tasks. In this paper, motivated by not changing the network topology and protocols, we propose an improved VIDS that can efficiently detect the overlapped voltage attack of the in-vehicle CAN network. Before retraining the VIDS classifier model, we add the mechanism for detecting and filtering overlapped signals in the voltage samples by applying the Long Short-Term Memory (LSTM) autoencoder network to preserve the fingerprint characteristics of the benign waveform in the original samples. First, we establish an LSTM autoencoder model with benign voltages collected in a usual scenario and then apply the automatic thresholding approach to obtain the threshold to separate the overlapped and benign voltages. Next, we filter the overlapped voltages and extract the fingerprint features from the filtered voltage samples to predict the classification of the masquerade CAN packet during the attack. Finally, we evaluate the performance and attack success rate of the proposed VIDS on a CAN bus testbench. The results show that the proposed VIDS can effectively detect the overlapped voltage attack and identify the compromised ECU mimicking the distorted voltage fingerprints with an accuracy of 99.4%. The attack success rate of the proposed VIDS drops to 0∼18%, which is about 60∼95% for the existing VIDS.

An Integrated Approach to Securing In-Vehicle CAN Bus Network Using ECU Fingerprinting and Image Classification Techniques

An Integrated Approach to Securing In-Vehicle CAN Bus Network Using ECU Fingerprinting and Image Classification Techniques

A Deep Learning-Based IDS for Automotive Theft Detection for In-Vehicle CAN Bus

A Deep Learning-Based IDS for Automotive Theft Detection for In-Vehicle CAN Bus

Multiple Observation HMM-Based CAN Bus Intrusion Detection System for In-Vehicle Network

As modern vehicles become more intelligent and connected, the number of ECUs and communication interfaces with external networks (such as 3G/4G and Bluetooth) has increased significantly, which raises potential network security risks. Due to the absence of effective security measures, there is a frequent occurrence of cybersecurity incidents targeting vehicles, particularly the in-vehicle CAN bus network. As the main bus in the vehicle, CAN bus faces important challenges in its safety due to the lack of security mechanisms. Therefore, we propose a CAN bus intrusion detection system based on multiple observation HMM for in vehicle networks to enhance the security of the vehicle. Specifically, the proposed algorithm builds a multiple observation HMM based on the ID and data fields of normal CAN bus traffic. According to the established HMMs, we calculate the existence probability of the frame under the defined time window as the detection threshold. When the existence probability of the frame to be detected exceeds the normal threshold range, it is considered abnormal. Furthermore, we establish four common attack models based on the collected real vehicle data, and evaluate the performance of the proposed algorithm in these attack scenarios. The experimental results show that the proposed method has better detection performance than other frame by frame anomaly detection methods in four attack scenarios.

CAN-LOC: Spoofing Detection and Physical Intrusion Localization on an In-Vehicle CAN Bus Based on Deep Features of Voltage Signals

CAN-LOC: Spoofing Detection and Physical Intrusion Localization on an In-Vehicle CAN Bus Based on Deep Features of Voltage Signals

A Provable Secure Session Key Distribution Protocol Based on NSSK for In-Vehicle CAN Network

Many CAN-based session key sharing approaches are based on the group key scheme, which can easily lead advanced adversaries to infiltrate all ECUs (electronic control units) in the network if the sharing key is leaked. To address the above problem, we propose a provable secure session key distribution protocol based on the improved NSSK (Needham–Schroeder shared key) protocol for the in-vehicle CAN network. We applied the mechanisms of message authentication and digital signature to fix the defects of the original NSSK regarding its lack of resistance to the Denning–Sacco attack. Then, we analyzed the provable security of the proposed protocol on the random oracle model and verified the security goals of the protocol by using the simulation tools AVISPA and Tamarin Prover; the results reflect that the protocol met the security requirements for key distribution such as session key secrecy, injective agreement, and known key secrecy. Finally, we compared our new protocol with other key distribution protocols in CAN bus communication to evaluate the performance of the new protocol in actual scenarios. The result shows that the protocol is secure against many payload-based attacks and is practical for in-vehicle CAN networks.

Intrusion Detecting System Based on Temporal Convolutional Network for In-Vehicle CAN Networks

In recent years, deep learning theories, such as Recurrent Neural Networks (RNN) and Convolutional Neural Networks (CNN), have been applied as effective methods for intrusion detection in the vehicle CAN network. However, the existing RNNs realize detection by establishing independent models for each CAN ID, which are unable to learn the potential characteristics of different IDs well, and have relatively complicated model structure and high calculation time cost. CNNs can achieve rapid detection by learning the characteristics of normal and attack CAN ID sequences and exhibit good performance, but the current methods do not locate abnormal points in the sequence. To solve the above problems, this paper proposes an in-vehicle CAN network intrusion detection model based on Temporal Convolutional Network, which is called Temporal Convolutional Network-Based Intrusion Detection System (TCNIDS). In TCNIDS, the CAN ID is serialized into a natural language sequence and a word vector is constructed for each CAN ID through the word embedding coding method to reduce the data dimension. At the same time, TCNIDS uses the parameterized Relu method to improve the temporal convolutional network, which can better learn the potential features of the normal sequence. The TCNIDS model has a simple structure and realizes the point anomaly detection at the message level by predicting the future sequence of normal CAN data and setting the probability strategy. The experimental results show that the overall detection rate, false alarm rate, and accuracy rate of TCNIDS under fuzzy attack, spoofing attack, and DoS attack are higher than those of the traditional temporal convolutional network intrusion detection model.

An Adaptive Intrusion Detection Algorithm for In-vehicle CAN Bus Based on Periodicity of Message

Alongside with the convergence of In-vehicle network (IVN) and wireless communication technology, In-vehicle CAN communication with external networks reinforces the connectivity among systems of a vehicle. Vehicle communication is facing severe challenges. Intrusion detection technology is one of the most widely used technologies to ensure the safety of In-vehicle CAN communication, so an adaptive intrusion detection method for In-vehicle CAN bus based on message periodicity is proposed. Communication load of CAN bus in the vehicle, the unique priority mechanism and transmission waiting mechanism of CAN message cause a certain fluctuation in the message cycle. The influence of this fluctuation on the detection accuracy of intrusion detection algorithm is analysed while rules are determined by establishing and optimizing the detection threshold in order to further improve the accuracy. Experimental results show that the adaptive intrusion detection based on message periodicity can effectively detect injection and interruption attacks.

In-Vehicle CAN Bus Tampering Attacks Detection for Connected and Autonomous Vehicles Using an Improved Isolation Forest Method

In-Vehicle CAN Bus Tampering Attacks Detection for Connected and Autonomous Vehicles Using an Improved Isolation Forest Method

Practical Sender Authentication Scheme for In-Vehicle CAN With Efficient Key Management

Recently, Various security techniques are developed to provide security for In-vehicle CAN, but the limited characteristics of CAN protocol make it hard to apply them to a real vehicle. In this paper, we propose a sender authentication and key management schemes considering the limitations of In-vehicle CAN. Our proposed security scheme is designed considering the computing power of automotive ECU and the limited-size CAN data frame. Further, we suggest an efficient key management scheme causing no communication overhead in a session key update process. The security scheme has a structure that may be implemented without change of CAN standards. To evaluate the performance and security of the proposed scheme, we conduct hardware and network simulator based evaluation. Finally, through the analysis on the security and performance, we prove that our proposed scheme is suitable for solving the problem of In-vehicle CAN authentication.

VoltageIDS: Low-Level Communication Characteristics for Automotive Intrusion Detection System

The proliferation of computerized functions aimed at enhancing drivers' safety and convenience has increased the number of vehicular attack surfaces accordingly. The fundamental vulnerability is caused by the fact that the controller area network protocol, a de facto standard for in-vehicle networks, does not support message origin authentication. Several methods to resolve this problem have been suggested. However, most of them require modification of the CAN protocol and have their own vulnerabilities. In this paper, we focus on securing in-vehicle CAN networks, proposing a novel automotive intrusion detection system (so-called VoltageIDS). The system leverages the inimitable characteristics of an electrical CAN signal as a fingerprint of the electronic control units. The noteworthy contributions are that VoltageIDS does not require any modification of the current system and has been validated on actual vehicles while driving on the road. VoltageIDS is also the first automotive intrusion detection system capable of distinguishing between errors and the bus-off attack. Our experimental results on a CAN bus prototype and on real vehicles show that VoltageIDS detects intrusions in the in-vehicle CAN network. Moreover, we evaluate VoltageIDS while a vehicle is moving.

Cloud-Based Cyber-Physical Intrusion Detection for Vehicles Using Deep Learning

Detection of cyber attacks against vehicles is of growing interest. As vehicles typically afford limited processing resources, proposed solutions are rule-based or lightweight machine learning techniques. We argue that this limitation can be lifted with computational offloading commonly used for resource-constrained mobile devices. The increased processing resources available in this manner allow access to more advanced techniques. Using as case study a small four-wheel robotic land vehicle, we demonstrate the practicality and benefits of offloading the continuous task of intrusion detection that is based on deep learning. This approach achieves high accuracy much more consistently than with standard machine learning techniques and is not limited to a single type of attack or the in-vehicle CAN bus as previous work. As input, it uses data captured in real-time that relate to both cyber and physical processes, which it feeds as time series data to a neural network architecture. We use both a deep multilayer perceptron and recurrent neural network architecture, with the latter benefitting from a long-short term memory hidden layer, which proves very useful for learning the temporal context of different attacks. We employ denial of service, command injection and malware as examples of cyber attacks that are meaningful for a robotic vehicle. The practicality of computation offloading depends on the resources afforded onboard and remotely, and the reliability of the communication means between them. Using detection latency as the criterion, we have developed a mathematical model to determine when computation offloading is beneficial given parameters related to the operation of the network and the processing demands of the deep learning model. The more reliable the network and the greater the processing demands, the greater the reduction in detection latency achieved through offloading.