In-vehicle Network Research Articles

Resilient Raw Format Live Video Streaming Framework for an Automated Driving System on an Ethernet-Based In-Vehicle Network

Resilient Raw Format Live Video Streaming Framework for an Automated Driving System on an Ethernet-Based In-Vehicle Network

CarTwin—Development of a Digital Twin for a Real-World In-Vehicle CAN Network

Digital twins are used to replicate the behavior of physical systems, and in-vehicle networks can greatly benefit from this technology. This is mainly because in-vehicle networks circulate large amounts of data coming from various sources such as wired, or in some cases even wireless, sensors that are fused by actuators responsible for safety-critical tasks that require careful testing. In this work, we build a laboratory in-vehicle network that mimics a real vehicle network in regards to wire length, number of stubs and devices that are connected to it. The Controller Area Network (CAN), which is still the most popular communication bus inside cars, is used as a network layer. Using models defined in MATLAB for various subsystems, e.g., Anti-lock Braking System (ABS), Powertrain and Electric Power-Steering, deployed on automotive-grade microcontrollers, we evaluate the in-vehicle bus digital twin by providing realistic inputs and recording and reproducing in-vehicle network traffic. The experimental results showed good correlation between the output of the implemented digital twin and the data collected from an actual car.

Congestion Intrusion Detection-Based Method for Controller Area Network Bus: A Case for KIA SOUL Vehicle

In the vehicle industry, connectivity and autonomy are becoming increasingly important features. One of the most used protocols for in-vehicle communication is the Controller Area Network (CAN) bus which manages the communication between networked components. However, the CAN bus, despite its critical importance, lacks sufficient security features to protect its network as well as the overall car system. Thus, vehicle network security is becoming increasingly crucial. Methods of intrusion detection help to improve the security of the in-vehicle network. This work aims to provide a model that enables effective detection of attacks such as fuzzy, DoS, and impersonation using the Deep Feedforward Neural Network (DeepFNN) model as well as the Long Short-Term Memory model. Moreover, the LSTM model presents the most satisfying outcome in terms of precision and recall metrics.

Privacy pitfalls of releasing in-vehicle network data

The ever-increasing volume of vehicular data has enabled different service providers to access and monetize in-vehicle network data of millions of drivers. However, such data often carry personal or even potentially sensitive information, and therefore service providers either need to ask for drivers' consent or anonymize such data in order to comply with data protection regulations. In this paper, we show that both fine-grained consent control as well as the adequate anonymization of in-network vehicular data are very challenging. First, by exploiting that in-vehicle sensor measurements are inherently interdependent, we are able to effectively i) re-identify a driver even from the raw, unprocessed CAN data with 97% accuracy, and ii) reconstruct the vehicle's complete location trajectory knowing only its speed and steering wheel position. Since such signal interdependencies are hard to identify even for data controllers, drivers' consent will arguably not be informed and hence may become invalid. Second, we show that the non-systematic application of different standard anonymization techniques (e.g., aggregation, suppression, signal distortion) often results in volatile, empirical privacy guarantees to the population as a whole but fails to provide a strong, worst-case privacy guarantee to every single individual. Therefore, we advocate the application of principled privacy models (such as Differential Privacy) to anonymize data with strong worst-case guarantee.

Intrusion Detection System for Internet of Vehicles Based on Ensemble Learning and CNN

With the combination of network and automotive technology, more and more modern cars are controlled based on electronic control units (ECUs). And multiple ECUs in modern cars are interconnected and cooperate through the in-vehicle network. But such in-vehicle networks do not consider potential security issues, which might lead to property damage and life threat. An intrusion Detection System (IDS) is a method to detect anomalies and warn about network intrusions. In this study, an IDS model based on Convolutional Neural Networks (CNNs) and ensemble learning is proposed. Meanwhile, to further improve the capability of the proposed IDS model, the structure of some CNN basic models is modified. Finally, the proposed model is validated on a representative standard Internet of Vehicles (IoV) dataset Car-Hacking Dataset. In the experiment, the proposed model achieves 100% accuracy and fl-score, and the detection time is from 1.0ms to 2.8ms, which demonstrates that the proposed IDS model detects the effectiveness of network intrusions.

Highly Accurate Clock Synchronization With Drift Correction for the Controller Area Network

Modern vehicles, that have to be considered as safety-critical cyber-physical systems, require highly accurate <i>clock synchronization</i> (CS) among their distributed computing devices. Since Controller Area Network (CAN) is the predominant in-vehicle communication bus, it is highly relevant to support CS for CAN. This article proposes an original CS method for distributed in-vehicle networks based on CAN with both <i>offset</i> and <i>drift correction</i> . While offset correction is performed based on timestamps in periodic reference messages (RMs), our new method benefits from the re-synchronization mechanism of the CAN bit timing to apply highly accurate drift correction. Our algorithm does not make any modifications to the CAN protocol but requires the measurement of the phase error from the CAN controller. We derive analytical bounds for the expected clock differences and further validate the practicability of the proposed method by comprehensive experiments. As the main result, our method achieves a clock accuracy below <inline-formula><tex-math notation="LaTeX">$2\;\mu$</tex-math></inline-formula> s independent of important parameters such as the bit rate, RM period, bus utilization and time-varying clock drifts.

Intrusion, anomaly, and attack detection in smart vehicles

With the advancement of technology and Internet penetration in all aspects of life in today's modern world, smart vehicles, particularly connected vehicles, are rising. As a result, as smart vehicles have evolved and grown in popularity, so have the cyber threats that threaten them. Vehicles may communicate with other vehicles, road infrastructure, and other smart devices; as a result, the security of related equipment must be ensured. Researchers presented many articles investigating smart vehicle intrusion, anomaly, and attack detection methods. In most of these, researchers only examined the proposed detection methods on in-vehicle networks (IVNs) and external networks for smart ground vehicles. However, reviewing and analyzing the detection methods provided in all communications and connections related to smart ground/air vehicles is necessary. This paper examines the detection methods for in-vehicle networks, inter-vehicle networks, ground vehicle power stations, and the Internet of Drones (IoD). Besides, it analyzes recently published studies in the four categories: intrusion detection systems (IDSs), anomaly detection, attack detection, and hybrid detection methods in smart vehicles. The methods examined in this survey were published in 2018–2022 in reputable journals such as Elsevier, IEEE, Springer, ScienceDirect, etc. We examine datasets, simulations/implementations, and key evaluation criteria for each detection method studied. Also, we compare these methods using appropriate tables and diagrams and analyze the problems in detecting intrusions, anomalies, and attacks in smart vehicles. Finally, we address the research questions and discuss future research challenges.

Intrusion Detection for In-Vehicle CAN Bus Based on Lightweight Neural Network

With the rapid development of automobile intelligent and networking, substantial information is exchanged between in-vehicle network system and the outside world, thereby threatening the automobile security. Intrusion detection is an important technology to realize the security of in-vehicle networks. The existing research on in-vehicle network intrusion detection mainly focuses on the improvement of detection accuracy, but it lacks consideration of timeliness, whereas the in-vehicle network is a time-sensitive system. This study proposes an anomaly detection method for in-vehicle Controller Area Network (CAN) based on lightweight neural network to reduce the operation time while maintaining the detection accuracy. The redundant neuron screening method and model compression algorithm for layer-by-layer neuron pruning are designed. This presented method can delete the neurons with small contribution and obtain lightweight neural network model. The detection performance of model compression and noncompression is compared through experiments. Results show that under the two real in-vehicle datasets, the detection time is accelerated by 47.7 times and 34.2 times at most, and the average accuracy is increased by 14.5% and 15.7%.

Research on a Vehicle Authentication and Key Transmission Protocol Based on CPN

With the rapid development of the Internet of Vehicles, the increase in vehicle functional requirements has led to the continuous increase in complex electronic systems, and the in-vehicle network is extremely vulnerable to network attacks. The controller area network (CAN) bus is the most representative in-vehicle bus technology in intra-vehicular networks (IVNs) for its flexibility. Although the current framework to protect the safety of CAN has been proposed, the safety communication mechanism between electronic control units (ECUs) in the vehicle network is still weak. A large number of communication protocols focus on the addition of safety mechanisms, and there is a lack of general protocol formal modeling and security assessment. In addition, many protocols are designed without considering key updates and transmission, ECUs maintenance, etc. In this work, we propose an efficient in-vehicle authentication and key transmission scheme. This scheme is a certificateless framework based on identity cryptography, which can not only ensure the security of the in-vehicle network but also meet the real-time requirements between ECUs. Moreover, this scheme can reduce the complexity of key management for centralized key generators. To evaluate the security of this scheme, we adopt a protocol model detection method based on the combination of the colored Petri net (CPN) and the Dolev–Yao attack model to formally evaluate the proposed protocol. The evaluation results show that the proposed scheme can effectively prevent three types of man-in-the-middle attacks.

Federated AI-Enabled In-Vehicle Network Intrusion Detection for Internet of Vehicles

The integration of artificial intelligence (AI) technology into the Internet of Vehicles (IoV) has provided smart services for intelligent connected vehicles (ICVs). However, due to gradually upgrading to ICVs, an increasing number of external communications interfaces exposes the in-vehicle networks (IVNs) to malicious network intrusion. The malicious intruders can take over the compromised ICVs and mediately intrude into the ICVs connected through IoV. Therefore, it is urgent to develop IVN intrusion detection methods for IoV security protection. In this paper, a ConvLSTM-based IVN intrusion detection method is developed by leveraging the periodicity of the network message ID. For training the ConvLSTM model, a federated learning (FL) framework with client selection is proposed. The fundamental FL framework works in the client-server mode. ICVs are the local clients, and mobile edge computing (MEC) servers connected to base stations (BSs) function as the parameter servers. Based on the framework, a proximal policy optimization (PPO)-based federated client selection (FCS) scheme is further developed to optimize the model accuracy and system overhead of federated ConvLSTM model training. Simulations are conducted by the exploitation of real-world IoV scenario settings and IVN datasets. The results indicate that by exploiting the ConvLSTM, the model size and convergence time are dramatically reduced, and the 95%-beyond detection accuracy is maintained. The results also unveil that the PPO-based FCS scheme outperforms the benchmarks on the convergence rate, model accuracy, and system overhead.

A deep learning-based intrusion detection system for in-vehicle networks

Modern vehicles are increasingly getting connected within the vehicles, with other systems, leading to more concerns about security. Controller area network (CAN) has become a de-facto standard for connecting internal vehicles’ components. However, it lacks security features. Conventional security mechanisms fail to protect in-vehicle networks from attacks, requiring the development of an effective intrusion detection system (IDS). This work develops an IDS for in-vehicle networks called IDS-IVN based on a compact representation of location invariant and time-variant traffic features using deep learning. The IDS-IVN uses convolutional neural and long–short-term memory networks as encoder/decoder functions of autoencoder networks to extract features from raw data and classify them using latent space representation into intrusive and non-intrusive classes. A benchmark real-time ROAD dataset is used to demonstrate the IDS-IVN’s performance compared to the existing methods. IDS-IVN reports 99% accuracy with a 0.32% low false-positive rate for detecting intrusions.

DAGA: Detecting Attacks to In-Vehicle Networks via N-Gram Analysis

Recent research showcased several cyber-attacks against unmodified licensed vehicles, demonstrating the vulnerability of their internal networks. Many solutions have already been proposed by industry and academia, aiming to detect and prevent cyber-attacks targeting in-vehicle networks. The majority of these proposals borrow security algorithms and techniques from the classical ICT domain, and in many cases they do not consider the inherent limitations of legacy automotive protocols and resource-constrained microcontrollers. This paper proposes <bold xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">DAGA</b> , an anomaly detection algorithm for in-vehicle networks exploiting <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$n-$</tex-math></inline-formula> gram analysis. DAGA only uses sequences of CAN message IDs for the definition of the <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$n-$</tex-math></inline-formula> grams used in the detection process, without requiring the content of the payload or other CAN message fields. The DAGA framework allows the creation of detection models characterized by different memory footprints, allowing their deployment on microcontrollers with different hardware constraints. Experimental results based on three prototype implementations of DAGA showcase the trade off between hardware requirements and detection performance. DAGA outperforms the state-of-the-art detectors on the most performing microcontrollers, and can execute with lower performance on simple microcontrollers that cannot support the vast majority of IDS approaches proposed in literature. As additional contributions, we publicly release the full dataset and our reference DAGA implementations.

Domain Adversarial Neural Network-Based Intrusion Detection System for In-Vehicle Network Variant Attacks

A controller area network (CAN) bus that controls real-time communication and data transmission of electronic control units in vehicles lacks security mechanisms and is highly vulnerable to attacks. The detection effectiveness of existing In-Vehicle network intrusion detection systems (IDSs) is usually reliant on training samples of known attacks. Owing to the simple structure of the CAN bus protocol, attackers can easily create variants based on known attacks. In this study, we propose a CAN bus IDS based on a domain adversarial neural network, which can achieve high detection performance on unlearned variant attack data. In addition, we used feature fusion techniques to synthetically extract the features of the attack data to improve detection capability. The experimental results demonstrate that our proposed model has high performance and generalization ability in attack detection.

SOME/IP Intrusion Detection System Using Machine Learning

With the development of in-vehicle network technologies, Automotive Ethernet is being applied to modern vehicles. Scalable service-Oriented MiddlewarE over IP (SOME/IP) is an automotive middleware solution that is used for communications of the infotainment domain as well as that of other domains in the vehicle. However, since SOME/IP lacks security, it is vulnerable to a variety of network-based attacks. In this paper, we introduce a new type of intrusion detection system (IDS) leveraging on SOME/IP packet's header information and packet reception time to deal with SOME/IP related network attacks.

Voltage-Based Physical Layer Fault Diagnosis for Controller Area Network

Controller Area Network (CAN) is the most prevalent communication protocol used in the automotive industry. This in-vehicle network provides a means communication between Electronic Control Units (ECUs) and components within the vehicle. The recent rapid development of connected, electric, and autonomous vehicles expands the complexity and information exchange within CAN and demands an increase in the reliability of the network. Efficient system-level diagnosis functions need to be integrated over the network to ensure for reliability and enhance the ease of troubleshooting.&#x0D; This paper presents a method to identify physical CAN faults such as loss of electrical connections and shorted wires. Fault signatures of predefined physical CAN faults are used to detect and identify the failure modes. The method can identify both permanent and intermittent faults caused by, for instance, damaged connectors and vibrations, respectively.&#x0D; Diagnosis tasks are implemented on in-vehicle module by measuring and processing physical layer voltages of all CAN buses. A real-time data buffer of a predefined size is utilized to calculate health indicators from the physical layer CAN voltages. The health indicators are then compared to predefined thresholds to determine the presence and type of the fault. Compared to ground truth data, the results show that the presented method can identify with high accuracy physical CAN faults including open electrical connection and shorted wires.

DESC-IDS: Towards an efficient real-time automotive intrusion detection system based on deep evolving stream clustering

Controller area network (CAN) is a widely used communication protocol for in-vehicle networks. With the up-gradation of traditional vehicle ad-hoc networks (VANETs) to the internet of vehicles (IoV), the connectivity is incremental between the vehicular network and the outside world, making cyber-security become a stringent problem. Although existing machine learning-based methods for automotive intrusion detection are powerful, there are still limitations in detection performance and resistance attack types during the unsupervised learning process that lacks massive amounts of labels. Therefore, this paper proposes an in-vehicle intrusion detection system that incorporates a combination of sparse regularization convolutional auto-encoder (SRCAE) and streams clustering to construct a deep evolving stream clustering model, namely DESC-IDS. Specifically, the method encodes continuous messages as 2-D data frames, which are fed into the SRCAE built by the temporal convolutional network (TCN) to obtain a low-dimensional non-linear spatial–temporal mapping of the high-dimensional data. Thereafter, the stream clustering model can describe a contour baseline of normal communication messages by the spatial–temporal features. Based on this baseline, DESC-IDS can detect any abnormal changes in vehicular communication. In particular, this paper exploits the SRCAE to reconstruct message matrices, which are considered as variants of known attacks due to reconstruction deviation. The extensive evaluation results illustrate that the proposed model provides enough performance and real-time competitiveness in anomaly detection, with 96.44% accuracy on the HCRL intrusion dataset and 98.80% accuracy on the ORNL intrusion dataset. For the mixed attack of fabrication and masquerade, the proposed model achieves stable F1-scores of 93.48% and 86.99%, respectively. Moreover, the performance in unknown attacks is righteous with 98.43% accuracy and 97.15% F1-scores.

Dynamic Rearrangement Compression Algorithm for Intelligent Connected Vehicles

The intelligent vehicle terminal T-BOX of intelligent connected vehicles (ICVs) is directly connected to the vehicle interface and constantly exchanges real-time data inside and outside the vehicle, which significantly increases the communication pressure on the in-vehicle network. Excessive data will increase the load on the channel due to the limited bandwidth of the vehicle. Although the existing data compression algorithm can effectively reduce the communication pressure, it requires significant driving data to count the number of signal changes, which increases the preliminary labor cost. Meanwhile, it is difficult to meet the stable compression rate using a static configuration when a large amount of CAN data is transmitted with fluctuating data changes, which cannot satisfy the requirement of reducing the bus load rate, and satisfying the real-time requirements of ICV is challenging. Thus, we propose a real-time dynamic data compression algorithm for vehicles to satisfy such requirements. The experiments show that for the frequently changing signals, the proposed algorithm can improve the compression rate by about 10% compared with the existing compression algorithm. The execution time of the compression process is 4.55 μs at a clock frequency of 400 MHz and the decompression process execution time is 86.48 μs. Compared with the bus load when the original message is transmitted, the proposed algorithm can reduce the bus load by 19% on average. In the future, a stable compression rate will be crucial when loading authentication codes on the CAN to ensure its security.

Software-Based AUTOSAR-Compliant Precision Clock Synchronization Over CAN

Modern cars are characterized by a growing number of sensors, actuators, and advanced driver assistance systems that require a synchronized view of the time. These devices are typically interconnected by CAN, which is still the most important in-vehicle network. Precise clock synchronization over CAN is difficult due to the properties of the bus, and current approaches often use dedicated hardware or proprietary software solutions. A few years ago, however, the AUTomotive Open System ARchitecture (AUTOSAR) development alliance published a standardized synchronization method. In this article, we investigate what synchronization precision can be realistically achieved in a real-world automotive hardware and software environment. This involves pure software timestamping, standard CAN controllers without hardware modifications, and a typical automotive real-time operating system. We evaluate several approaches to reduce the synchronization jitter using filtering and optimizing the timestamping procedure. Experiments show that, ultimately, a precision better than 50 <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$\mu$</tex-math></inline-formula> s can be achieved with a fully AUTOSAR-compliant software implementation.

Security Analysis on Blockchain-Powered Mobile APPs Connected with In-Vehicle Networks by Context-Based Reverse Engineering

The controller area network (CAN) bus for interconnection of electronic control units (ECUs) plays a highly important role in modern intelligent vehicles. To facilitate the CAN Bus accessing to vehicle control or diagnosis, a number of mobile APPs are designed and published by automobile manufacturers to support driving and vehicle-based social network, and some are realized through the in-vehicle infotainment (IVI) middleware. Blockchain technologies are also mature for automobiles to interact service information with the whole industry. Unfortunately, there is a serious threat of command leakage from these mobile APPs, and the reverse engineering (RE) can be exploited by hackers. Previous work has researched this threat by an automatic reverse engineering tool on both automotive android and IOS APPs. However, in such common tool, APP itself-related contexts, including the feature information of CAN Bus commands, vehicle application functions, and control diagnostic protocols, are overlooked, which might be utilized to promote the reverse engineering recall. In this paper, we propose a context-based reverse engineering approach to find deep hidden commands for further revealing security threats for blockchain-powered mobile automotive APPs. For the reverse engineering, we design a context model of four-order tensor to organize multidimensional contexts and establish a continuous updating mechanism. Based on the context model, we further develop two basic analysis algorithms, max-compute (A) and clustering (A), to perform the analysis of CAN Bus commands. Extensive experiments are conducted, and we evaluate it by two metrics, recovered ratio and correctness ratio. Experimental results and the case studied on the familiar APP Carly validate the effectiveness of our approach and reveal the threat of command leakage.

Designing and implementing an AUTOSAR-based Basic Software Module for enhanced security

Electronic Control Units (ECUs) communicate with each other to accomplish the functionalities of modern vehicles. ECUs form an in-vehicle network that is precisely regulated and must be adequately protected from malicious activity, which has had several outbreaks in recent years. Therefore, we present CINNAMON, an AUTOSAR-based Basic Software Module that aims at confidentiality, integrity and authentication, all at the same time, for the traffic exchanged over the bus protocols that AUTOSAR supports. CINNAMON in fact stands for Confidential, INtegral aNd Authentic onboard coMmunicatiON.This article introduces the requirements and specification of CINNAMON in a differential fashion with respect to the existing Secure Onboard Communication Basic Software Module, which does not include confidentiality. As a result, CINNAMON exceeds SecOC at least against information gathering attacks. The article then defines three security profiles, regulating also the freshness attribute appropriately. Most importantly, CINNAMON is not a simple academic exercise because it is implemented in a laboratory environment on commercial ECUs, thus reaching the level of TRL 4, “Component and/or breadboard validation in laboratory environment”. The runtimes obtained on inexpensive devices are reassuring, paving the way for a possible large-scale application.