Abstract:With the deep integration of the Internet of Things (IoT) technology and the increase of computational power and memory, vehicles can also serve as the infrastructures for Intelligent Transportation System (ITS), e.g., as fog nodes. However, when connecting vehicles to the internet, alongside with the benefits it brings, it also opens many new challenges such as security attacks. Controller Area Network (CAN) is one of the main in-vehicle communication protocols in modern cars. Its lack of sender verification mechanism makes CAN particularly vulnerable to cyber-attacks including masquerade attack. Fingerprinting Electronic Control Units (ECUs) based on hardware characteristics has been proved feasible and effective on defending CAN buses. However, most state-of-the-art works exploited the supervised learning algorithm to identify the transmitter based on the signal characteristics. This makes the decision process hard to understand, and it also limits the deployment on proprietary CAN bus without prior knowledge. To solve this, we design a novel clock-skew-based approach capable of pinpointing the sender and detecting intrusion on proprietary CAN bus. We take a single CAN frame as the object for measurement, and adjust the measuring process such that our approach can be independent of the transmission time of frames. Based on the statistical analysis of data from real vehicles, we propose a novel box-plot algorithm based on score mechanism to filter the raw data. Finally, the clock skews are estimated and accumulated to build a linear model for representing the transmitter ECU. The evaluation results on one CAN prototype and two production vehicles show that our approach is able to well identify and differentiate ECUs on the bus without prior knowledge. The data processed by the proposed box-plot algorithm can describe the hardware characteristics of ECUs precisely. We also show the ability of our approach to protecting the CAN bus against the masquerade attack.

An Experimental Study Towards Attacker Identification in Automotive Networks.

An Entropy Analysis based Intrusion Detection System for Controller Area Network in Vehicles

Viden: Attacker Identification on In-Vehicle Networks

A Delay Based Plug-in-Monitor for Intrusion Detection in Controller Area Network.

TCE-IDS: Time Interval Conditional Entropy- Based Intrusion Detection System for Automotive Controller Area Networks

Security Modeling and Analysis on Intra Vehicular Network.

A Model-Based Method for Enabling Source Mapping and Intrusion Detection on Proprietary Can Bus

Side Channel Analysis: A Novel Intrusion Detection System Based on Vehicle Voltage Signals

Domain Adversarial Neural Network-Based Intrusion Detection System for In-Vehicle Network Variant Attacks

CAN-LOC: Spoofing Detection and Physical Intrusion Localization on an In-Vehicle CAN Bus Based on Deep Features of Voltage Signals

Intrusion Detection Method for In-Vehicle CAN Bus Based on Message and Time Transfer Matrix

Intrusion detection and defence for CAN bus through frequency anomaly analysis and arbitration mechanism

Covert Channel-Based Transmitter Authentication in Controller Area Networks

CANsec: A Practical in-Vehicle Controller Area Network Security Evaluation Tool

On the Robustness of Signal Characteristic-Based Sender Identification

CANAttack: Assessing Vulnerabilities within Controller Area Network

Two-Point Voltage Fingerprinting: Increasing Detectability of ECU Masquerading Attacks

CANflict: Exploiting Peripheral Conflicts for Data-Link Layer Attacks on Automotive Networks

Practical IDS on In-vehicle Network Against Diversified Attack Models

A Survey and Comparative Analysis of Security Properties of CAN Authentication Protocols

CANCloak: Deceiving Two ECUs with One Frame