A Lightweight FPGA-based IDS-ECU Architecture for Automotive CAN

The vehicle industry is quickly becoming more connected and growing. This growth is due to advancements in cyber physical systems (CPSs) that enhance the safety and automation in vehicle. The modern automobile consists of more than 70 electronic control units (ECUs) that communicate and interact with each other over automotive bus systems. Passenger comforts, infotainment features, and connectivity continue to progress through the growth and integration of Internet-of-Things (IoT) technologies. Common networks include the Controller Area Network (CAN), Local Interconnect Network (LIN), and FlexRay. However, the benefits of increased connectivity and features comes with the penalty of increased vulnerabilities. Security is lacking in preventing attacks on safety-critical control systems. I will explore the state of the art methods and approaches researchers have taken to identify threats and how to address them with intrusion detection. I discuss the development of a hybrid based intrusion detection approach that combines anomaly and signature based detection methods. Machine learning is a hot topic in security as it is a method of learning and classifying system behavior and can detect intrusions that alter normal behavior. In this paper, we discuss utilizing machine learning algorithms to assist in classifying CAN messages. I present work that focuses on the reverse engineering and classification of CAN messages. The problem is that even though CAN is standardized, the implementation may vary for different manufacturers and vehicle models. These implementations are kept secret, therefore CAN messages for every vehicle needs to be analyzed and reverse engineered in order to get information. Due to the lack of publicly available CAN specifications, attackers and researchers need to reverse engineer messages to pinpoint which messages will have the desired impact. The reverse engineering process is needed by researchers and hackers for all manufacturers and their respective vehicles to understand what the vehicle is doing and what each CAN message means. The knowledge of the specifications of CAN messages can improve the effectiveness of security mechanisms applied to CAN.

The rapid evolution of software-driven functionalities in modern vehicles has led to the availability of advanced driving assistance systems. In tandem with the above developments, the increasing number of sensors in vehicles to support such new features has led to a significant rise in the number of in-vehicle electronic control units (ECUs), network interfaces, and communication protocols. This growing complexity enhances vehicle performance, connectivity, and comfort applications. The increased connectivity to the outside world, however, introduces new securitychallenges. As automotive networks become more interconnected, they are exposed to a wider array of cyber threats that endanger the safety of passengers as well as threaten the loss of their personal and private information. This necessitates the inclusion of robust Intrusion Detection Systems (IDS) in vehicular networks to safeguard vehicle communications. Given the importance of the problem, multiple IDSs have been proposed in the research literature in the past 10 years. However, conventional IDS implementations often impose significant computational overhead, requiring additional ECUs and network elements that can contribute to increased system cost, complexity, and power consumption. In this thesis, the feasibility of consolidating intrusion detection capabilities within critical ECUs is explored to establish an efficient, embedded IDS architecture for modern automotive networks. By integrating IDS functionalities into hybrid ECU architectures, the aim is to mitigate the need for additional hardware peripherals utilised as IDSs while maintaining a robust approach to network security. This thesis focuses on the widely used Controller Area Network (CAN) protocol, which serves as the backbone of in-vehicle communication, enabling real-time and reliabledata exchange among ECUs. To enhance network security, approaches are proposed that integrate quantised machine learning-based IDS models as lightweight, isolated security modules within ECU hardware. This minimises disruptions to standard software tasks while ensuring efficient per-message handling for real-time detection. To evaluate the feasibility of this approach, three key aspects have been investigated: (1) whether IDS models can be lightweight enough for embedded deployment, (2) their generalisability across multiple datasets and unseen attack types, and (3)their ability to support per-message detection at line rates. The proposed IDS models are trained to detect a diverse range of cyber threats, including Denial-of-Service (DoS), Fuzzing, and Spoofing attacks, which pose significant risks to automotive networks. The experimental results demonstrate that the proposed IDSs achieve high detection accuracy across multiple attack vectors while maintaining low per-message processing latency and minimal energy consumption. This ensures compliance with the stringent constraints of real-time automotive environments, making embeddeddeployment of IDSs within a vehicle’s network both practical and efficient. By leveraging the consolidation of IDS capabilities within critical ECUs, my research contributes to the advancement of secure and resilient automotive network architectures, paving the way for enhanced cybersecurity in next-generation vehicles.

The Controller Area Network (CAN) is widely used in in-vehicle networks. As increasing the number of Electronic Control Units (ECUs) in an in-vehicle system, the delay of the CAN message is critical issues to achieve high accuracy of the control applications. This protocol employs an arbitration mechanism for priority-based transmission, therefore, although it is easy to estimate the worst-case response time (WCRT) of each message by using real-time scheduling theory, there is no way to know the delay time at which each CAN message was generated in the run-time environment. To address this issue, in this paper, we propose a method is to notify the real delay time of each message without synchronizing to global time between each node in the run-time environment. Our proposed method can provide the delay time of each CAN message with a small improvement so it can be applied for the existing in-vehicle systems.

The modern car is increasingly connected. That connection is magnified by the presence of a large number of electronic control units (ECUs). The communication between the ECUs of a modern car is assured by the Controller Area Network (CAN) bus system. Despite its importance, the CAN bus system is bereft of security mechanisms making it vulnerable to numerous security attacks. When an attacker succeeds in compromising the ECUs, they can take control and stop the engine, disable the brakes, turn the lights on/off, etc. An intrusion detection system (IDS) can be deployed as an appropriate security measure to detect the malicious network traffic in the CAN bus system. In this paper, we propose a Convolutional Neural Network (CNN)-based network attacks IDS for protecting the CAN bus system. For efficiency reasons, we generated our own datasets from three car models. Our experiment results demonstrate that our classifier is efficient for detecting the CAN bus system attacks, and it performs with a high accuracy of 99.99% and a detection rate of 0.99.

The Controller Area Network (CAN) bus system works inside connected cars as a central system for communication between electronic control units (ECUs). Despite its central importance, the CAN does not support an authentication mechanism, i.e., CAN messages are broadcast without basic security features. As a result, it is easy for attackers to launch attacks at the CAN bus network system. Attackers can compromise the CAN bus system in several ways: denial of service, fuzzing, spoofing, etc. It is imperative to devise methodologies to protect modern cars against the aforementioned attacks. In this paper, we propose a Long Short-Term Memory (LSTM)-based Intrusion Detection System (IDS) to detect and mitigate the CAN bus network attacks. We first inject attacks at the CAN bus system in a car that we have at our disposal to generate the attack dataset, which we use to test and train our model. Our results demonstrate that our classifier is efficient in detecting the CAN attacks. We achieved a detection accuracy of 99.9949%.

As de facto standards of in-vehicle network communications among various ECUs (Electronic Control Units), CAN (Controller Area Network) protocols invented by Bosch rely on the privately-defined unique identifiers CAN ID in CAN messages which do not convey any destination address. On the other hand, sticking to error handling mechanisms in CAN protocols, an ECU with an amount of transmission errors would enter bus-off state (i.e., go offline thereupon) and shall be recovered according to some prescribed bus-off recovery mode (BOM). All these sensitive CAN knowledge concealed inside an ECU by OEMs (Original Equipment Manufacturers) shall not be revealed and could be found extensive practical applications to both adversarial behavior (e.g., target ECU attacks) and security enhancement mechanisms (e.g., intrusion detection system designs). The paper presents FirmCAN, the first automatic analysis framework to dope out sensitive CAN knowledge (CAN IDs and bus-off recovery mode in particular) compiled in automotive ECU firmwares. FirmCAN first identifies base address (using accurate absolute function entry addresses), and then performs CAN module API positioning and sensitive configuration information resolution. We buckle down to automotive ECUs that resort to fixed-address mailboxes as CAN module transmission buffers (e.g., Renesas SuperH/RA series) and present concrete algorithms for each analysis phase. Our experimental evaluations first investigate firmwares extracted from real automotive ECUs. We then develop our own applications using RA6M4 development boards, which not only produce required firmwares to evaluate FirmCAN, but also create ground truth through hardware debugging. All evaluations demonstrate that FirmCAN can accurately garner above-mentioned sensitive CAN knowledge. FirmCAN can be trivially generalized to engage in extended frames and CAN modules with similar transmission logic, e.g., TI (Texas Instruments), ST (ST Microelectronics), etc.

There have been several public demonstrations of attacks on connected vehicles showing the ability of an attacker to take control of a targeted vehicle by injecting messages into their Controller Area Network (CAN) bus. In this article, using injected speed reading and Revolutions Per Minute (RPM) reading messages in in-motion vehicle, we examine the ability of the Pearson correlation and the unsupervised learning methods k-means clustering and Hidden Markov Model (HMM) to differentiate ’no-attack’ and ’under-attack’ states of the given vehicle. We found that the Pearson correlation distinguishes the two states, the k-means clustering method has an acceptable accuracy but high false positive rate and HMM detects attacks with acceptable detection rate but has a high false positive in detecting attacks from speed readings when there is no attack. The accuracy of these unsupervised learning methods are comparable to the ones of the supervised learning methods used by CAN bus Intrusion Detection System (IDS) suppliers. In addition, the article shows that studying CAN anomaly detection techniques using off-vehicle test facilities may not properly evaluate the performance of the detection techniques. The results suggest using other features besides the data content of the CAN messages and integrate knowledge about how the Electronic Control Units (ECUs) collaborate in building effective techniques for the detection of injection of fabricated message attacks.

Controller area network (CAN) data-reduction techniques have been developed to reduce CAN bus loads, which have increased due to the large number of electronic control units in modern automobiles. Automotive communication uses various in-vehicle network. These techniques make it possible that same information to be sent using less bandwidth. However, the existing CAN DR algorithms only consider the CAN network. Automotive communication uses various in-vehicle network (IVN) protocols such as CAN, FlexRay, and Ethernet. The use of DR techniques may cause compatibility issue in heterogenous IVNs. This paper proposes a gateway system for data-reduced communication between Ethernet and CAN systems with data-reduction. The proposed gateway system receives a compressed CAN message, decompresses it, and transmits it to the Ethernet network. Additionally, the gateway receives a normal Ethernet message, compresses it, and transmits it to the CAN protocol. An evaluation of the performance of the developed gateway system is also presented.

<div class="section abstract"><div class="htmlview paragraph">The amount of data communicated in automotive networks is increasing rapidly, leading to more complex systems alongside the rising number of Electronic Control Units (ECUs) in modern vehicles. As the number of ECUs has risen, Controller Area Network (CAN) communication bandwidth has been pushed to its limit. Existing solutions - such as using multiple CAN buses, sending multiple CAN frames or switching to another protocol - require a significant system-design effort and replacement of hardware and software. This has paved the way for CAN Flexible Data-rate (CAN FD), which extends the CAN standard and permits significantly higher data rates, enabling faster firmware upgrades. However, some changes must be made like: exchange the classical CAN microcontroller with a CAN FD microcontroller and also a CAN FD transceiver must be used.</div><div class="htmlview paragraph">This article will explore the benefits of CAN FD, how it compares with the classical CAN protocol, requirements for systems and how to introduce CAN FD into existing CAN networks.</div></div>

Recently, numerous electronic components are installed in vehicles, providing drivers and passengers with increased safety and convenience. The electronic components construct an in-vehicle network that internally shares relevant status information about the vehicle. As modern vehicles become more computerized, the potential for automotive cyber-security threats also increases a fact that has been illustrated clearly by various car-hacking demonstrations. Using the controller area network (CAN), the de facto standard protocol in the automotive industry that facilitates in-vehicle network communication, car-hacking demonstrations inject critical CAN messages to control vehicular functions. In efforts to address this security issue, car manufacturers, in turn, have made confidential the CAN database (i.e., DBC format file), where signal information assigned in the CAN data payload is specified. However, it has since become known that this policy does not hermetically seal a vehicular network against cyber attacks. On the contrary, in-depth automotive security research has been hindered significantly because of the limited information accessible by researchers. For example, automotive intrusion detection systems (IDS) identify and alert when there is a vehicular break-in, and this technology is a major area of study in automotive cyber security research. For the automotive IDS that analyzes CAN traffic, information in the DBC format file greatly improves detection veracity. However, most IDS technologies to date have been independently developed without the confidential CAN DB information and, as a result, do not mitigate threats to a satisfactory standard. In this paper, we propose an enhanced method that identifies signal boundaries in a CAN data payload, which is specified in the DBC format file. Unlike an existing method that is designed based on total bit-flip rates, our method analyzes bit-flip time series not total bit-flip rates so that signal boundaries can be more clearly identified. In this paper, we use a publicly available DBC format file called OpenDBC as a reference, and show that our method outperforms the existing method.

Controller Area Networks (CANs) are critical components of modern vehicles and industrial systems, facilitating communication between various electronic control units. However, the widespread connectivity and lack of inherent security measures make CANs vulnerable to cyber-attacks. Intrusion detection systems (IDS) safeguard CANs by detecting and mitigating potential attacks. This paper presents a comprehensive analysis of current methods for the real-time detection of attacks in CANs. The IDSs based on different input data modalities are evaluated based on their effectiveness, accuracy, and efficiency. The analysis highlights the strengths and limitations of each method, providing valuable insights for researchers and practitioners in developing robust and reliable intrusion detection systems for CANs. The findings suggest that the lightweight strategy in IDS is widely accepted for real-time application due to its computational simplicity and model structure. Furthermore, the paper identifies future directions to enhance the security of CANs and ensure their resilience against evolving threats.

The rapid integration of connectivity and intelligence in modern vehicles has significantly increased the attack surface of in-vehicle networks, particularly the Controller Area Network (CAN) bus. Traditional intrusion detection systems (IDS) often struggle to achieve high detection accuracy while maintaining low computational overhead suitable for real-time automotive environments. To address these challenges, this paper proposes a modified Enhanced Cuckoo Filter–based Intrusion Detection System, referred to as a Quantum-Inspired Ensemble IDS, for secure CAN bus communication. In the proposed approach, a self-learning enhanced cuckoo filter (ECF) is employed as a fast pre-filtering mechanism to efficiently separate known normal and malicious CAN traffic patterns, thereby reducing unnecessary deep model computations. Subsequently, a quantum-inspired feature enhancement module is introduced to enrich CAN message representations using simulated quantum rotation and superposition concepts. The enhanced features are then processed by an ensemble of deep learning models, including a Temporal Attention Transformer, CNN-LSTM network, Quantum-Inspired Neural Network, and a hybrid deep model, whose outputs are combined using weighted voting for final intrusion classification. The proposed system is evaluated using the Car Hacking Dataset (CHD) and the CAN train-and-test dataset under multiple attack scenarios such as DoS, fuzzy, gear, and RPM attacks. Experimental results demonstrate that the proposed method achieves over 99.9% detection accuracy, lower detection latency (<1 ms per sample), and reduced CPU utilization compared to existing ECF-IDS and state-of-the-art CAN intrusion detection methods. Realistic performance evaluation confirms that the proposed system is highly effective, computationally efficient, and suitable for real-time deployment in automotive environments.

Controller Area Network (CAN) is the main bus network that connects electronic control units in automobiles. Although CAN protocols have been revised to improve the vehicle safety, the security weaknesses of CAN have not been fully addressed. Security threats on automobiles might be from external wireless communication or from internal malicious CAN nodes mounted on the CAN bus. Despite of various threat sources, the security weakness of CAN is the root of security problems. Due to the limited computation power and storage capacity on each CAN node, there is a lack of hardware-efficient protection methods for the CAN system without losing the compatibility to CAN protocols. To save the cost and maintain the compatibility, we propose to exploit the built-in CAN fault confinement mechanism to detect the masquerade attacks originated from the malicious CAN devices on the CAN bus. Simulation results show that our method achieves the attack misdetection rate at the order of 10-5 and reduces the encryption latency by up to 68% over the complete frame encryption method.

Proliferation of connected services in modern vehicles could make them vulnerable to a wide range of cyber-attacks through intra-vehicle networks that connect various vehicle systems. Designers usually equip vehicles with predesigned counter-measures, but these may not be effective against novel cyber-attacks. Intrusion Detection Systems (IDSs) serve as an additional layer of defence when conventional measures that are implemented by the designers fail. Several intrusion detection techniques, such as rule-based IDS, have been proposed in the literature but these techniques have limited capability in detecting novel cyber-attacks. This paper proposes a new Machine Learning (ML)-based IDS for detecting novel cyber-attacks in intra-vehicle networks, specifically in Controller Area Networks (CANs). The proposed IDS generates high-level representations of CAN messages transmitted on the bus exploiting their temporal properties as well as the intra and inter message dependencies through the use of Recurrence Plot (RP), which are then fed into a bespoke Neural Network, designed and trained to detect novel intrusions. Evaluations of the performance of the proposed IDS in comparison with that of the state-of-the-art existing IDS schemes namely Decision Tree (DT), Random Forest (RF) and other well-known approaches demonstrate the superiority of the proposed IDS in this paper.

The Partial controller area network (CAN), which can partially turn on and off the operation of electronic control unit (ECU), is a low-power technology and can reduce the CO2 emissions and power consumption of an automobile compared with the existing automobile CAN. However, a problem arises in the application of the Partial CAN whereby the existing automobile CAN databases that contain all the CAN frames of the automobile have many period frames. The periodic frame wakes the ECU every constant cycle, so the power consumption and CO2 emissions savings of ECU are ineffective. To solve this problem, we proposed a new algorithm for applying the Partial CAN that can evade the period wake-up of the ECU. In this paper, we introduce a new algorithm for applying the Partial CAN and analyze the performance of the proposed algorithm by comparing with the existing algorithm.