Intrusion Detection Systems for In-Vehicle Networks: Protocols, Applications, and Challenges

With the rapid development of autonomous vehicles (AVs), vehicle safety has attracted attention. Controller area network (CAN) bus without authentication and encryption mechanisms is a weakness of the in-vehicle network (IVN), and attackers always primarily target the CAN bus. Attacks on the AVs' CAN bus are more frequent because AVs have more external interfaces and sensors than ordinary vehicles. To address the abovementioned issues, this paper proposes a lightweight encryption and authentication scheme for the CAN bus of AVs using message authentication codes and Grain stream cipher. The scheme realizes efficient authentication between electronic control units and a counter re-synchronization protocol is used to ensure that authentication failure owing to counter inconsistency is prevented. Blom key management scheme is employed to rapidly distribute and update session keys, avoiding the complicated process of updating pairwise keys. In addition, considering the scalability of the IVN, a key distribution protocol for new nodes was provided. The security proof using Burrows-Abadi-Needham logic and security analysis prove that the proposed scheme can satisfy the security requirements of the IVN. In addition, performance analysis shows that the proposed scheme can meet real-time requirements and has little impact on the busload.

The Controller Area Network (CAN) bus system works inside connected cars as a central system for communication between electronic control units (ECUs). Despite its central importance, the CAN does not support an authentication mechanism, i.e., CAN messages are broadcast without basic security features. As a result, it is easy for attackers to launch attacks at the CAN bus network system. Attackers can compromise the CAN bus system in several ways: denial of service, fuzzing, spoofing, etc. It is imperative to devise methodologies to protect modern cars against the aforementioned attacks. In this paper, we propose a Long Short-Term Memory (LSTM)-based Intrusion Detection System (IDS) to detect and mitigate the CAN bus network attacks. We first inject attacks at the CAN bus system in a car that we have at our disposal to generate the attack dataset, which we use to test and train our model. Our results demonstrate that our classifier is efficient in detecting the CAN attacks. We achieved a detection accuracy of 99.9949%.

The modern car is increasingly connected. That connection is magnified by the presence of a large number of electronic control units (ECUs). The communication between the ECUs of a modern car is assured by the Controller Area Network (CAN) bus system. Despite its importance, the CAN bus system is bereft of security mechanisms making it vulnerable to numerous security attacks. When an attacker succeeds in compromising the ECUs, they can take control and stop the engine, disable the brakes, turn the lights on/off, etc. An intrusion detection system (IDS) can be deployed as an appropriate security measure to detect the malicious network traffic in the CAN bus system. In this paper, we propose a Convolutional Neural Network (CNN)-based network attacks IDS for protecting the CAN bus system. For efficiency reasons, we generated our own datasets from three car models. Our experiment results demonstrate that our classifier is efficient for detecting the CAN bus system attacks, and it performs with a high accuracy of 99.99% and a detection rate of 0.99.

There have been several public demonstrations of attacks on connected vehicles showing the ability of an attacker to take control of a targeted vehicle by injecting messages into their Controller Area Network (CAN) bus. In this article, using injected speed reading and Revolutions Per Minute (RPM) reading messages in in-motion vehicle, we examine the ability of the Pearson correlation and the unsupervised learning methods k-means clustering and Hidden Markov Model (HMM) to differentiate ’no-attack’ and ’under-attack’ states of the given vehicle. We found that the Pearson correlation distinguishes the two states, the k-means clustering method has an acceptable accuracy but high false positive rate and HMM detects attacks with acceptable detection rate but has a high false positive in detecting attacks from speed readings when there is no attack. The accuracy of these unsupervised learning methods are comparable to the ones of the supervised learning methods used by CAN bus Intrusion Detection System (IDS) suppliers. In addition, the article shows that studying CAN anomaly detection techniques using off-vehicle test facilities may not properly evaluate the performance of the detection techniques. The results suggest using other features besides the data content of the CAN messages and integrate knowledge about how the Electronic Control Units (ECUs) collaborate in building effective techniques for the detection of injection of fabricated message attacks.

As connectivity between and within vehicles increases, so does concern about safety and security. Various automotive serial protocols are used inside vehicles such as Controller Area Network (CAN), Local Interconnect Network (LIN), and FlexRay. CAN Bus is the most used in-vehicle network protocol to support exchange of vehicle parameters between Electronic Control Units (ECUs). This protocol lacks security mechanisms by design and is therefore vulnerable to various attacks. Furthermore, connectivity of vehicles has made the CAN Bus vulnerable not only from within the vehicle but also from outside. With the rise of connected cars, more entry points and interfaces have been introduced on board vehicles, thereby also leading to a wider potential attack surface. Existing security mechanisms focus on the use of encryption, authentication, and vehicle Intrusion Detection Systems (IDS), which operate under various constraints such as low bandwidth, small frame size (e.g., in the CAN protocol), limited availability of computational resources, and real-time sensitivity. We survey and classify current cryptographic and IDS approaches and compare these approaches based on criteria such as real-time constraints, types of hardware used, changes in CAN Bus behaviour, types of attack mitigation, and software/ hardware used to validate these approaches. We conclude with mitigation strategies limitations and research challenges for the future.

<div>The controller area network (CAN) bus, the prevailing standard for in-vehicle networking (IVN), has been used for more than four decades, despite its simple architecture, to establish communications between electronic control units (ECUs). Weight, maintenance overheads, improved flexibility, and wiring complexity escalate as the quantity of ECUs rises, especially for high-demand autonomous vehicles (AVs). The primary objective of this study is to examine and discuss the significant challenges that arise during the migration from a wired CAN to a wireless CAN (WCAN). Suggested remedies include changing the configuration of the conventional ECU, creating a hidden wireless communication domain for each AV, and developing a plan to counteract the jamming signals. The simulation of the proposed WCAN was done using MATLAB and validated using OPNET analysis. The results showed that the packet loss of the eavesdropping electronic control unit ranged from 63% to 100%. Anti-jamming results show that when packet loss reaches 2% for a continuous period of time of 0.01 sec, the passive channel is automatically activated, ensuring secure data transmission.</div>

An in-vehicle controller area network (CAN) bus is vulnerable because of increased sharing among modern autonomous vehicles and the weak protocol design principle. Spoofing attacks on a CAN bus can be difficult to detect and have the potential to enable devastating attacks. To effectively identify spoofing attacks, we propose the authentication of sender identities using a recurrent neural network with long short-term memory units (RNN-LSTM) based on the features of a fingerprint signal. We also present a way to generate the analog fingerprint signals of electronic control units (ECUs) to train the proposed RNN-LSTM classifier. The proposed RNN-LSTM model is accelerated on embedded Field-Programmable Gate Arrays (FPGA) to allow for real-time detection despite high computational complexity. A comparison of experimental results with the latest studies demonstrates the capability of the proposed RNN-LSTM model and its potential as a solution to in-vehicle CAN bus security.

Controller Area Network (CAN) is an effective choice for the automotive industries due to its simplicity, low cost nature, decrease of wiring density and in addition to that it provide connectivity with multiple nodes with single wiring pair. This paper aims in describing an ARM 7 LPC 2129 based Temperature measurement system with Controller Area Network (CAN) bus. Objective of this paper is to construct a hardware proposal for communication between nodes with CAN bus. A Node to Node communication link has been established which are connected via CAN bus so as to observe and control the temperature values transferring on the CAN bus and send the command signals onto the another node. The hardware boards are designed to be capable of supporting high speed bit rate up to 1Mbps. The CAN communication module can transmit or receive data following CAN Protocol. With the help of the software used, the CAN-BUS communication would be clear to the nodes of the ARM 7 Controllers in the system. The software part is done in KEIL microvision-4 using Embedded -C.

Modern vehicles have significantly increased the number of Internet of Things (IoT) devices called electronic control units (ECUs) connected by in-vehicle networks to provide enhanced features and safety. These devices communicate with the environment and have brought the notion of the Internet of vehicles. The controller area network (CAN) bus facilitates efficient ECU communications and is the standard protocol used by every vehicle, but it is susceptible to remote attacks. Consequently, it is desirable to monitor the CAN bus for malicious activities, such as data injection attacks, that can compromise the vehicular operations. We present an anomaly detection technique that uses an extreme gradient boosting machine (GBM) learning algorithm to categorize unexpected occurrences in the CAN data payload. We further combine GBM with a ten-fold cross-validation method to improve prediction performance. Moreover, we use the early -stopping and grid search approaches to overcome overfitting without affecting model accuracy. We evaluate our detection approach on real CAN bus datasets collected from Hyundai Sonata, a KIA Soul, and Chevrolet Spark with different attack scenarios, such as Denial-of-Service (DoS), fuzzy, spoofing, and malfunction attacks. Using standard metrics, such as accuracy, recall, precision, F1 score, and false-positive rate, the performance analysis of the proposed model achieved an overall accuracy of over 99 percent.

With rapid advancements in in-vehicle network (IVN) technology, the demand for multiple advanced functions and networking in electric vehicles (EVs) has recently increased. To enable various intelligent functions, the electrical system of existing vehicles incorporates a controller area network (CAN) bus system that enables communication among electrical control units (ECUs). In practice, traditional network-based intrusion detection systems (NIDSs) cannot easily identify threats to the CAN bus system. Therefore, it is necessary to develop a new type of NIDS—namely, on-the-move Intrusion Detection System (OMIDS)—to categorise these threats. Accordingly, this paper proposes an intrusion detection model for IVNs, based on the VGG16 classifier deep learning model, to learn attack behaviour characteristics and classify threats. The experimental dataset was provided by the Hacking and Countermeasure Research Lab (HCRL) to validate classification performance for denial of service (DoS), fuzzy attacks, spoofing gear, and RPM in vehicle communications. The proposed classifier’s performance was compared with that of the XBoost ensemble learning scheme to identify threats from in-vehicle networks. In particular, the test cases can detect anomalies in terms of accuracy, precision, recall, and F1-score to ensure detection accuracy and identify false alarm threats. The experimental results show that the classification accuracy of the dataset for HCRL Car-Hacking by the VGG16 and XBoost classifiers (n = 50) reached 97.8241% and 99.9995% for the 5-subcategory classification results on the testing data, respectively.

With the development of autonomous vehicle technology, the controller area network (CAN) bus has become the de facto standard for an in-vehicle communication system because of its simplicity and efficiency. However, without any encryption and authentication mechanisms, the in-vehicle network using the CAN protocol is susceptible to a wide range of attacks. Many studies, which are mostly based on machine learning, have proposed installing an intrusion detection system (IDS) for anomaly detection in the CAN bus system. Although machine learning methods have many advantages for IDS, previous models usually require a large amount of labeled data, which results in high time and labor costs. To handle this problem, we propose a novel semi-supervised learning-based convolutional adversarial autoencoder model in this paper. The proposed model combines two popular deep learning models: autoencoder and generative adversarial networks. First, the model is trained with unlabeled data to learn the manifolds of normal and attack patterns. Then, only a small number of labeled samples are used in supervised training. The proposed model can detect various kinds of message injection attacks, such as DoS, fuzzy, and spoofing, as well as unknown attacks. The experimental results show that the proposed model achieves the highest F1 score of 0.9984 and a low error rate of 0.1% with limited labeled data compared to other supervised methods. In addition, we show that the model can meet the real-time requirement by analyzing the model complexity in terms of the number of trainable parameters and inference time. This study successfully reduced the number of model parameters by five times and the inference time by eight times, compared to a state-of-the-art model.

This paper introduces the principle of controller area network (CAN) bus and the structure of fuel cell vehicle control system based on CAN bus. It focuses on electrical air -condition control system for fuel cell vehicle based on CAN bus, which consists of an air condition control node and an air condition compressor drive. The design of electrical air condition control system based on CAN bus is analyzed in detail, including hardware design and software design. The hardware design mainly includes a general-purpose microcontroller P89C51Rx2, a dedicated microcontroller ST72141 for brushless DC Motor and an independent CAN controller etc.. The running result of air-condition control system proves the flexibility and efficiency and reliability of the system design.

The controller-area network (CAN) bus has a wide range of applications. It plays a key role in information transfer. In fact, a failure of the CAN bus causes information transfer to fail. Therefore, fault diagnosis of the CAN bus is necessary. In addition, CAN bus failures generally result from sample imbalance problems. Therefore, this study proposes a CAN bus fault diagnosis (CANFD) method that integrates a Laplace network (LaplaceCNN) and uses a class-imbalance dataset. The method first utilises the adaptive synthetic (ADASYN) oversampling algorithm to process the class-imbalance CANFD dataset. LaplaceCNN is trained on the processed balanced dataset to diagnose CAN bus faults. To collect the frequency-domain characteristics and feed them into the deep network, LaplaceCNN uses Laplace wavelet convolution as the initial layer of the network. Multiscale wide convolutional and dense residual blocks are proposed to enhance the feature extraction capability of LaplaceCNN and stabilise the model performance. Introducing focal loss further improves the performance of LaplaceCNN on a class-imbalanced dataset. Experiments demonstrate that the proposed method performs better in terms of fault diagnosis.

<title>ABSTRACT</title> <p>This paper describes the strategies and challenges involved to secure vehicles which use automotive Ethernet-based networks. Since the early 1990’s, the Controller Area Network (CAN) bus has been the standard in automotive networking systems. However, automotive Ethernet is becoming more common in recent years and is considered the future in automotive networking. This new technology has unique advantages over traditional CAN bus networks (e.g. higher bandwidth that can support hashing and encryption), and it still requires additional security measures such as monitoring and detection of anomalies to better secure the vehicle. Southwest Research Institute (SwRI) has previously developed a CAN-only intrusion detection system (IDS) which protects a vehicle’s CAN bus by actively monitoring traffic and flagging messages that are identified as anomalies. SwRI successfully implemented the ability to read, train, and detect on automotive Ethernet data in the IDS. The integration of automotive Ethernet in the IDS unveiled numerous challenges and lessons learned throughout its development.</p> <p><bold>Citation:</bold> P. Moldenhauer, J. Esquivel “Automotive Ethernet Cyberattack Defense in Ground Vehicles”, In <italic>Proceedings of the Ground Vehicle Systems Engineering and Technology Symposium</italic> (GVSETS), NDIA, Novi, MI, Aug. 16-18, 2022.</p>

As modern vehicles continue to evolve, advanced technologies are integrated to enhance the driving experience. A key enabler of this advancement is the Controller Area Network (CAN) bus, which facilitates seamless communication between vehicle components. Despite its widespread adoption, the CAN bus was not designed with security as a priority, making it vulnerable to various attacks. In this paper, we propose CANGuard, an Intrusion Detection System (IDS) designed to detect attacks on the CAN network and identify the originating node in real time. Using a simulated CAN-enabled system with four nodes representing diverse vehicle components, we generated a dataset featuring Denial-of-Service (DoS) attacks by exploiting the arbitration feature of the CAN bus, which prioritizes high-criticality messages (e.g., engine control) over lower-criticality ones (e.g., infotainment). We trained and evaluated several machine learning models for their ability to detect attacks and pinpoint the responsible node. Results indicate that Gradient Boosting outperformed other models, achieving high accuracy in both attack detection and node identification. While the Multi-Layer Perceptron (MLP) model demonstrated strong attack detection performance, it struggled with node identification, achieving less than 50% accuracy. These findings underscore the potential of tree-based models for real-time IDS applications in CAN-enabled vehicles.