In-vehicle Controller Area Network Research Articles

Windowed Hamming Distance-Based Intrusion Detection for the CAN Bus

The use of a Controller Area Network (CAN) bus in the automotive industry for connecting electronic control units (ECUs) poses security vulnerabilities due to the lack of built-in security features. Intrusion Detection Systems (IDSs) have emerged as a practical solution for safeguarding the CAN bus. However, developing an effective IDS for in-vehicle CAN buses encounters challenges in achieving high precision for detecting attacks and meeting real-time requirements with limited computational resources. To address these challenges, we propose a novel method for anomaly detection on CAN data using windowed Hamming distance. Our approach utilizes sliding windows and Hamming distance to extract features from time series data. By creating benchmark windows that span at least one cycle of data, we compare newly generated windows with recorded benchmarks using the Hamming distance to identify abnormal CAN messages. During the experimental phase, we conduct extensive testing on both the public car-hack dataset and a proprietary dataset. The experimental results indicate that our method achieves an impressive accuracy of up to 99.67% in detecting Denial of Service (DoS) attacks and an accuracy of 98.66% for fuzzing attacks. In terms of two types of spoofing attacks, our method achieves detection accuracies of 99.48% and 99.61%, respectively, significantly outperforming the methods relying solely on the Hamming distance. Furthermore, in terms of detection time, our method significantly reduces the time consumption by nearly 20-fold compared to the approach using deep convolutional neural networks (DCNN), decreasing it from 6.7 ms to 0.37 ms.

Stochastic sampled-data multi-objective control of active suspension systems for in-wheel motor driven electric vehicles

This paper addresses the sampled-data multi-objective active suspension control problem for an in-wheel motor driven electric vehicle subject to stochastic sampling periods and asynchronous premise variables. The focus is placed on the scenario that the dynamical state of the half-vehicle active suspension system is transmitted over an in-vehicle controller area network that only permits the transmission of sampled data packets. For this purpose, a stochastic sampling mechanism is developed such that the sampling periods can randomly switch among different values with certain mathematical probabilities. Then, an asynchronous fuzzy sampled-data controller, featuring distinct premise variables from the active suspension system, is constructed to eliminate the stringent requirement that the sampled-data controller has to share the same grades of membership. Furthermore, novel criteria for both stability analysis and controller design are derived in order to guarantee that the resultant closed-loop active suspension system is stochastically stable with simultaneous H2 and H∞ performance requirements. Finally, the effectiveness of the proposed stochastic sampled-data multi-objective control method is verified via several numerical cases studies in both time domain and frequency domain under various road disturbance profiles.

ICVTest: A Practical Black-Box Penetration Testing Framework for Evaluating Cybersecurity of Intelligent Connected Vehicles

Intelligent connected vehicles (ICVs) are equipped with extensive electronic control units which offer convenience but also pose significant cybersecurity risks. Penetration testing, recommended in ISO/SAE 21434 “Road vehicles—Cybersecurity engineering”, is an effective approach to identify cybersecurity vulnerabilities in ICVs. However, there is limited research on vehicle penetration testing from a black-box perspective due to the complex architecture of ICVs. Additionally, no penetration testing framework has been proposed to guide security testers on conducting penetration testing for the whole vehicle. The lack of framework guidance results in the inexperienced security testers being uncertain about the processes to follow for conducting penetration testing. Moreover, the inexperienced security testers are unsure about which tests to perform in order to systematically evaluate the vehicle’s cybersecurity. To enhance the penetration testing efficiency of ICVs, this paper presents a black-box penetration testing framework, ICVTest. ICVTest proposes a standardized penetration testing process to facilitate step-by-step completion of the penetration testing, thereby addressing the issue of inexperienced testers lacking guidance on how to initiate work when confronted with ICV. Also, ICVTest includes 10 sets of test cases covering hardware and software security tests. Testers can select appropriate test cases based on the specific cybersecurity threats faced by the target object, thereby reducing the complexity of penetration testing tasks. Furthermore, we have developed a vehicle cybersecurity testing platform for ICVTest that seamlessly integrates various testing tools. The platform enables even novice testers to conduct vehicle black-box penetration testing in accordance with the given guidance which addresses the current industry’s challenge of an overwhelming number of testing tasks coupled with a shortage of skilled professionals. For the first time, we propose a comprehensive black-box penetration testing framework and implement the framework in the form of a cybersecurity testing platform. We apply ICVTest to evaluate an electric vehicle manufactured in 2021 for assessing the framework’s availability. With the aid of ICVTest, even testers with limited experience in automotive penetration can effectively evaluate the security risks of ICVs. In our experiments, numerous cybersecurity vulnerabilities were identified involving in-vehicle sensors, remote vehicle control systems, and in-vehicle controller area network (CAN) bus.

Automotive Electronic Control Unit Ground Line Health Monitoring Method

Electronic Control Units (ECUs) have been used in the automotive industry for decades to control one or more of the vehicle subsystems. The ECUs communicate primarily using the in-vehicle Controller Area Network (CAN) communication protocol. The recent rapid development of connected, electric, and autonomous vehicles expands the number of ECUs and complexity of the CAN network required to integrate vehicle systems and deliver the desired functionalities. This demands increased reliability of the ECUs to ensure for robust vehicle performance. One of the most common ECU failure modes is the ECU ground fault. A ground fault occurs when the ground path in the ECU circuit is corroded, which is usually developed slowly over time. Such failure usually results in various symptoms including ECU incapable of functioning and further impacts the vehicle functionalities negatively. This type of fault can be difficult to detect prior to vehicle functionality loss. It usually involves routinely testing the resistance of the ground circuit, visually inspecting the connectors and wirings, and checking the voltage drop across the ground circuit. Therefore, it is highly desirable to continuously monitor the ECU ground line health status to predict any degradation and thus prevent vehicle functionality losses.
 This paper presents a novel method to monitor the health status of ECU ground line. The method leverages measured CAN voltage data to estimate the ECU ground state of health. The CAN voltage measurements are preprocessed and fed into a real-time data buffer of predefined size. Statistical moments are calculated from the buffered data to generate health indicators, which are then combined to form a fused health indicator. The fused health indicator is used to determine the health stage of ECU ground line. The health stage is classified based on the relationship between ground line degradation level and the ECU communication loss status. The method was developed and validated using actual vehicle data.

Bit scanner: Anomaly detection for in-vehicle CAN bus using binary sequence whitelisting

Due to the vulnerability of in-vehicle networks, particularly the Controller Area Network (CAN), malicious remote intrusion into vehicles has been a prominent public concern in recent years. The majority of existing technologies disregard the importance of the frame payload, making it difficult to detect tampered frames. In this paper, we propose Bit Scanner, a whitelist-based anomaly detection method that employs fine-grained checking for frame payload. Bit Scanner has no dependency on the CAN periodicity or CAN protocol. Its detection capabilities are evaluated using genuine CAN traffic collected from an autonomous bus. The results show that the proposed method has a malicious frames detection rate improvement of about 20% under replay attack scenarios, and a malicious packets detection rate improvement of at least 20% under tampering attack situations compared to the state-of-art methods.

A Digital Watermark Method for In-Vehicle Network Security Enhancement

In recent years, automobiles have become increasingly networked with the development of information and communication technology (ICT). With the enhancement of the connectivity between the electronic control units of the vehicle and the external network, cybersecurity and driving safety issues have also arisen. However, as a traditional in-vehicle network standard, the controller area network (CAN) protocol lacks a network security mechanism design, making it vulnerable to hacker attacks. The current research on the cybersecurity enhancement method for in-vehicle CAN is a multi-objective optimization problem with response time, bandwidth consumption and computational complexity reduction. This study presents an in-vehicle message authentication method based on digital watermark and Huffman coding that are compatible with current CAN bus protocols. Our method not only minimize the delay of message authentication, but also save the storage resources to the greatest extent. Moreover, to tackle the issue of low computing resources, multiple messages can be authenticated at one time. In order to evaluate the performance, we implement our method on CAN communication platform and validate its high accuracy, low latency, and compatibility.

Flooding attack mitigator for in-vehicle CAN using fault confinement in CAN protocol

For driver convenience and safety, a number of electronic control units (ECUs) have been installed on modern vehicles. To support communications among ECUs, the controller area network (CAN) is commonly used as in-vehicle network for several decades. However, the CAN protocol lacks security mechanisms, which means that it can be damaged by a number of cyber attacks. In particular, message flooding is one type of DoS attack known to be the easiest to perform because it continuously broadcasts a large number of CAN messages to the in-vehicle CAN without any CAN traffic analysis. To handle message flooding on the in-vehicle CAN, several countermeasures including intrusion detection and prevention have been studied, but unfortunately, these solutions could produce false positive detection rates or cause the communication failures of benign ECUs. In this paper, we introduce a message flooding attack mitigation method for the first time that does not accidentally cause the communication failures of benign ECUs. The proposed method can mitigate flooding attack attempts by using the fault confinement rule that is defined in the CAN protocol. Since the proposed method does not violate the rules of the CAN standard during mitigating, no system modifications are required. Experimental results show that the proposed mitigator guarantees a transmission rate up to 79.22% of normal messages that were not sent due to a flooding attack.

A Novel Hybrid Quantum-Classical Framework for an In-Vehicle Controller Area Network Intrusion Detection

A Novel Hybrid Quantum-Classical Framework for an In-Vehicle Controller Area Network Intrusion Detection

CarTwin—Development of a Digital Twin for a Real-World In-Vehicle CAN Network

Digital twins are used to replicate the behavior of physical systems, and in-vehicle networks can greatly benefit from this technology. This is mainly because in-vehicle networks circulate large amounts of data coming from various sources such as wired, or in some cases even wireless, sensors that are fused by actuators responsible for safety-critical tasks that require careful testing. In this work, we build a laboratory in-vehicle network that mimics a real vehicle network in regards to wire length, number of stubs and devices that are connected to it. The Controller Area Network (CAN), which is still the most popular communication bus inside cars, is used as a network layer. Using models defined in MATLAB for various subsystems, e.g., Anti-lock Braking System (ABS), Powertrain and Electric Power-Steering, deployed on automotive-grade microcontrollers, we evaluate the in-vehicle bus digital twin by providing realistic inputs and recording and reproducing in-vehicle network traffic. The experimental results showed good correlation between the output of the implemented digital twin and the data collected from an actual car.

Vehicle theft detection by generative adversarial networks on driving behavior

Human driving behavior can be a unique fingerprint to identify individual drivers and can be used for vehicle theft detection. Prior research often uses supervised learning to classify drivers’ behaviors. However, that method is not suitable for vehicle theft detection because it is not possible to derive a training dataset which comprehends all possible thieves. A few studies have instead leveraged unsupervised learning, such as k-means, but such approaches cannot achieve acceptable accuracy or provide a method of tolerating the false outcomes from classifying individual data points. Moreover, the influence of environment and road conditions on the driver classification was not included further limiting its usability. In this work, we propose a redesigned Generative Adversarial Network (GAN) model, Convolutional Long short-term GAN (CLGAN), which comprises long short-term memory (LSTM) and a convolutional neural network (CNN). This model ensures the ability of feature extraction from the convolutional layer and feature preservation from the LSTM layer, while simultaneously minimizing overfitting. It is instructive to analyze and benchmark CLGAN with the various GAN models, such as DCGAN, RNN-GAN, and AAE. Applying a public dataset which was generated by an electronic control unit (ECU) and collected through in-vehicle Controller Area Network (CAN) bus, our model achieves high accuracy of 98.5%, and is more robust against various driving conditions on multiple types of roads. In addition, we leverage threshold random walk to ensure the reliability of detection as well as adopting Principal Component Analysis (PCA) on feature pre-processing to improve the accuracy by approximately 20%. This work sheds light on a feasible and practical way of implementing vehicle theft detection.

Intrusion Detection for In-Vehicle CAN Bus Based on Lightweight Neural Network

With the rapid development of automobile intelligent and networking, substantial information is exchanged between in-vehicle network system and the outside world, thereby threatening the automobile security. Intrusion detection is an important technology to realize the security of in-vehicle networks. The existing research on in-vehicle network intrusion detection mainly focuses on the improvement of detection accuracy, but it lacks consideration of timeliness, whereas the in-vehicle network is a time-sensitive system. This study proposes an anomaly detection method for in-vehicle Controller Area Network (CAN) based on lightweight neural network to reduce the operation time while maintaining the detection accuracy. The redundant neuron screening method and model compression algorithm for layer-by-layer neuron pruning are designed. This presented method can delete the neurons with small contribution and obtain lightweight neural network model. The detection performance of model compression and noncompression is compared through experiments. Results show that under the two real in-vehicle datasets, the detection time is accelerated by 47.7 times and 34.2 times at most, and the average accuracy is increased by 14.5% and 15.7%.

Communication-Constrained Active Suspension Control for Networked In-Wheel Motor-Driven Electric Vehicles With Dynamic Dampers

This paper is concerned with the networked active suspension control problem for in-wheel motor-driven electric vehicles subject to communication constraints, including intermittent data transmissions, quantized output measurements and network-induced transmission delays. The central goal is to develop a resource-efficient communication and active suspension control co-design approach such that the limited in-vehicle network resources are occupied in an efficient manner, while simultaneously achieving the desired suspension system performance. For this purpose, a networked data transmission framework, incorporating a dynamic event-triggered communication mechanism and a logarithmic quantizer, is developed to accommodate the intermittent and digitalized packet-based transmissions over the in-vehicle controller area network channels. Specifically, the event triggering mechanism sporadically selects the sampled sensor data packets to be transmitted, which are then quantized before sending over the network channels. Then, formal stability and suspension performance analysis is carried out, and a co-design criterion on the existence of the desired triggering mechanism and event-triggered output feedback controller is further derived. Finally, the effectiveness and merits of the derived results are substantiated via several numerical case studies.

A CAN Bus Security Testbed Framework for Automotive Cyber-Physical Systems

The popularization of electronic devices and the enrichment of external interfaces have increased the attack surface of the automotive cyber-physical system (CPS). As a vital part of the CPS, the controller area network (CAN) is more vulnerable to security threats due to the lack of corresponding security protection mechanisms. This kind of security problem has also attracted extensive attention from academia and industry. Researchers have proposed numerous intrusion detection models for the in-vehicle CAN bus, solving some security problems to a certain extent. However, vehicle manufacturers seldom disclose the internal details of vehicle ECUs due to safety concerns. Thus, it is difficult for researchers to investigate the operation mechanism of the bus. Meanwhile, there is a risk of personal safety in completing attack experiments on real vehicles, which can also lead to the lack and diversification of in-vehicle network data, especially the data of attack behavior. Based on real vehicle data, an open, adaptable, and low-risk CAN bus security testbed framework in the automotive CPS is proposed in this study, aiming to enrich the operation data of the CAN bus and enhance the personal safety of researchers. Besides, the delay of the testbed sending and receiving periodic and aperiodic CAN messages is theoretically explored. The results demonstrate that the generated timestamp in the dataset is mainly associated with the timestamp of the real vehicle data and that the transmission and collection of time series data are completed by Algorithm 1 and Algorithm 2. In the evaluation of the security testbed, the stability of the security testbed is studied from the two indicators of delay and packet loss rate. The experiment reveals that the testbed has a small relative delay difference and a low packet loss rate. Moreover, the DTW algorithm is employed to calculate the distance between the real vehicle and the testbed, and the experimental results demonstrate that the testbed is featured with high similarity and simulation.

Illegal Intrusion Detection for In-Vehicle CAN Bus Based on Immunology Principle

The controller area network (CAN) bus has become one of the most commonly used protocols in automotive networks. Some potential attackers inject malicious data packets into the CAN bus through external interfaces for implementing illegal operations (intrusion). Anomaly detection is a technique for network intrusion detection which can detect malicious data packs by comparing the normal data packets with incoming data packets obtained from the network traffic. The data of a normal network is in a symmetric and stable state, which will become asymmetric when compromised. Considering the in-vehicle network, the CAN bus is symmetrically similar to the immune system in terms of internal network structure and external invasion threats. In this work, we use an intrusion detection method based on the dendritic cell algorithm (DCA). However, existing studies suggest the use of optimization methods to improve the accuracy of classification algorithms, and the current optimization of the parameters of the detection method mostly relies on the manual tuning of the parameters, which is a large workload. In view of the above challenges, this paper proposes a new detection algorithm based on the particle swarm optimization algorithm (PSO) and gravitational search algorithm (GSA) to improve the dendritic cell algorithm (PSO-GSA-DCA). PSO-GSA-DCA achieves adaptive parameter tuning and improves detection accuracy by mixing optimization algorithms and using them to optimize the dendritic cell algorithm classifier. Additionally, DCA-based CAN message attribute matching rules (measured by information gain and standard deviation of CAN data) are proposed for matching the three input signals (PAMP, DS, SS) of the DCA. The experimental results show that our proposed scheme has a significant improvement in accuracy, which can reach 91.64%, and lower time loss compared with other correlation anomaly detection schemes. Our proposed method also enables adaptive tuning, which solves the problem that most models now rely on manual tuning.

A novel intrusion detection model for the CAN bus packet of in-vehicle network based on attention mechanism and autoencoder

The attacks on in-vehicle Controller Area Network (CAN) bus messages severely disrupt normal communication between vehicles. Therefore, researches on intrusion detection models for CAN have positive business value for vehicle security, and the intrusion detection technology for CAN bus messages can effectively protect the in-vehicle network from unlawful attacks. Previous machine learning-based models are unable to effectively identify intrusive abnormal messages due to their inherent shortcomings. Hence, to address the shortcomings of the previous machine learning-based intrusion detection technique, we propose a novel method using Attention Mechanism and AutoEncoder for Intrusion Detection (AMAEID). The AMAEID model first converts the raw hexadecimal message data into binary format to obtain better input. Then the AMAEID model encodes and decodes the binary message data using a multi-layer denoising autoencoder model to obtain a hidden feature representation that can represent the potential features behind the message data at a deeper level. Finally, the AMAEID model uses the attention mechanism and the fully connected layer network to infer whether the message is an abnormal message or not. The experimental results with three evaluation metrics on a real in-vehicle CAN bus message dataset outperform some traditional machine learning algorithms, demonstrating the effectiveness of the AMAEID model.

Hybrid Quantum-Classical Neural Network for Cloud-Supported In-Vehicle Cyberattack Detection

A classical computer works with ones and zeros, whereas a quantum computer uses ones, zeros, and superpositions of ones and zeros, which enables quantum computers to perform a vast number of calculations simultaneously compared to classical computers. In a cloud-supported cyber−physical system environment, running a machine learning application in quantum computers is often difficult, due to the existing limitations of the current quantum devices. However, with the combination of quantum-classical neural networks (NN), complex and high-dimensional features can be extracted by the classical NN to a reduced but more informative feature space to be processed by the existing quantum computers. In this study, we developed a hybrid quantum-classical NN to detect an amplitude shift cyberattack on an in-vehicle controller area network dataset. We showed that by using the hybrid quantum-classical NN, it is possible to achieve an attack detection accuracy of 94%, which is higher than a long short-term memory NN (88%) or quantum NN alone (62%).

Intrusion Detection Method for In-Vehicle CAN Bus Based on Message and Time Transfer Matrix

As the number and computational power of electronic computing units installed in standard automobiles continue to increase, contemporary motor vehicles face more cybersecurity threats than previous designs, while providing greater convenience and various useful features. Although vehicles are attacked at various entry points, eventually, attacks are injected into the in-vehicle controller area network (CAN) to cause vehicle anomalies. Currently, OEMs and research fields have implemented protection for the CAN bus in terms of external interfaces, internal protocols, and intrusion detection. Although the deployment of intrusion detection solutions is the most effective approach, the main challenges currently faced by automobile intrusion detection algorithms in practice involve limited computing resources, insufficient real-time responsiveness, and low recognition accuracy. In this study, we propose a novel intrusion detection method based on the message and time transfer matrix to address these difficulties, which can be applied to the vehicle Electronic Control Unit (ECU) to achieve real-time attack signal identification with high accuracy. Experiments on actual vehicles show that the proposed algorithm identified various attacks with high accuracy while consuming less computational and storage resources than previous methods. Moreover, the efficiency of the proposed algorithm is not affected by the attack injection frequency. Compared with other methods, the proposed method achieved better attack identification performance. Additionally, the message and time transfer matrix used by the algorithm can be used as a message transfer fingerprint of the CAN bus to discover anomalies.

Bit-Level Automotive Controller Area Network Message Reverse Framework Based on Linear Regression.

Modern intelligent and networked vehicles are increasingly equipped with electronic control units (ECUs) with increased computing power. These electronic devices form an in-vehicle network via the Controller Area Network (CAN) bus, the de facto standard for modern vehicles. Although many ECUs provide convenience to drivers and passengers, they also increase the potential for cyber security threats in motor vehicles. Numerous attacks on vehicles have been reported, and the commonality among these attacks is that they inject malicious messages into the CAN network. To close the security holes of CAN, original equipment manufacturers (OEMs) keep the Database CAN (DBC) file describing the content of CAN messages, confidential. This policy is ineffective against cyberattacks but limits in-depth investigation of CAN messages and hinders the development of in-vehicle intrusion detection systems (IDS) and CAN fuzz testing. Current research reverses CAN messages through tokenization, machine learning, and diagnostic information matching to obtain details of CAN messages. However, the results of these algorithms yield only a fraction of the information specified in the DBC file regarding CAN messages, such as field boundaries and message IDs associated with specific functions. In this study, we propose multiple linear regression-based frameworks for bit-level inversion of CAN messages that can approximate the inversion of DBC files. The framework builds a multiple linear regression model for vehicle behavior and CAN traffic, filters the candidate messages based on the decision coefficients, and finally locates the bits describing the vehicle behavior to obtain the data length and alignment based on the model parameters. Moreover, this work shows that the system has high reversion accuracy and outperforms existing systems in boundary delineation and filtering relevant messages in actual vehicles.

Vehicular Multilevel Data Arrangement-Based Intrusion Detection System for In-Vehicle CAN

Modern vehicles are equipped with various types of electrical/electronic (E/E) systems. Electronic control units (ECUs) are used to control various E/E systems in the vehicle. For efficient information exchange between ECUs, most vehicle manufacturers use the Controller Area Network (CAN) protocol. However, CAN has security vulnerabilities because it does not have an authentication or encryption method. Since attacks on in-vehicle networks affect the safety of drivers, it is essential to develop a technology to prevent attacks. The intrusion detection system (IDS) is one of the best ways to enhance network security. Unlike the traditional IDS for network security, IDS for the in-vehicle network requires a lightweight algorithm because of the limitation of the computing power of in-vehicle ECUs. In this paper, we propose a lightweight IDS algorithm for in-vehicle CAN based on the degree of change between successive data frames. In particular, the proposed method minimizes the load on the ECU by using the CAN data frame compression algorithm based on exclusive-OR operations as a tool for calculating the degree of change.

GAN model using field fuzz mutation for in-vehicle CAN bus intrusion detection.

Controller area network (CAN) are widely used in smart vehicles to realize information interactions between electronic control units and other devices in vehicles. Owing to an increase in external communication interfaces, the cybersecurity of in-vehicle CAN bus networks is threatened. In-vehicle CAN intrusion detection systems with high detection rates and low false-negative rates have become important security protection measures for automotive networks. The boundary of the current machine learning-based in-vehicle CAN bus intrusion detection algorithm to determine the anomalous behavior triggered by CAN messages is unclear, and a validity check is required after the intrusion detection algorithm is designed. To solve the low coverage rate problem in the process of validating intrusion detection algorithms, an in-vehicle CAN fuzz-testing message generation model, the field-associative mutation generation adversarial network (FAMGAN), is proposed. To improve the defects of high randomness in generating messages in traditional fuzz-testing algorithms, FAMGAN adopts field division based on a conditional random field and the field association method based on the Apriori algorithm. Experiments were conducted on a real car using a code-built intrusion detection algorithm. The results demonstrate that FAMGAN can efficiently generate anomalous CAN messages and evaluate the performance of an in-vehicle CAN intrusion detection algorithm.