On Enabling Intrusion Detection Systems for Automotive Networks

Recent years have seen an exponential rise in complex software-driven functionality in vehicles, leading to a rising number of electronic control units (ECUs), network capabilities, and interfaces. These expanded capabilities also bring-in new planes of vulnerabilities making intrusion detection and management a critical capability; however, this can often result in more ECUs and network elements due to the high computational overheads. In this paper, we present a consolidated ECU architecture incorporating an Intrusion Detection System (IDS) for Automotive Controller Area Network (CAN) along with traditional ECU functionality on an off-the-shelf hybrid FPGA device, with near-zero overhead for the ECU functionality. We propose two quantised multi-layer perceptrons (QMLP's) as isolated IDSs for detecting a range of attack vectors including Denial-of-Service, Fuzzing and Spoofing, which are accelerated using off-the-shelf deep-learning processing unit (DPU) IP block from Xilinx, operating fully transparently to the software on the ECU. The proposed models achieve the state-of-the-art classification accuracy for all the attacks, while we observed a 15x reduction in power consumption when compared against the GPU-based implementation of the same models quantised using Nvidia libraries. We also achieved a 2.3x speed up in per-message processing latency (at 0.24 ms from the arrival of a CAN message) to meet the strict end-to-end latency on critical CAN nodes and a 2.6x reduction in power consumption for inference when compared to the state-of-the-art IDS models on embedded IDS and loosely coupled IDS accelerators (GPUs) discussed in the literature.

Controller Area Network (CAN) is one of the in-vehicle network protocols that is used to communicate among Electronic Control Units (ECUs) and has been de-facto standard. CAN is simple and has several vulnerabilities such as unable to distinguish spoofing messages because it doesn't support any authentication or sender identification properties. In previous work, some voltage-based methods to identify the sender node have been proposed. The methods can identify ECUs with high accuracy. However, the accuracy of source identification depends on a feature that is extracted from a continuous function of voltage use sampling. In general, as the sampling rate increases, the accuracy of identification is improved. Though the amount of data used for the identification increases too. Hence, it is desired to create an Intrusion Detection System (IDS) that identifies ECUs using few sampling features as there is a limited computing resource in vehicles. In this paper, we propose a delay-time based sender identification method of ECUs. We confirm that the proposed method achieved a true positive rate of 96.7% in CAN bus prototype against spoofing attack from a compromised ECU, detecting spoofing attack from an unmonitored ECU with a true positive rate of 98.0% in real-vehicle.

<div class="section abstract"><div class="htmlview paragraph">The amount of data communicated in automotive networks is increasing rapidly, leading to more complex systems alongside the rising number of Electronic Control Units (ECUs) in modern vehicles. As the number of ECUs has risen, Controller Area Network (CAN) communication bandwidth has been pushed to its limit. Existing solutions - such as using multiple CAN buses, sending multiple CAN frames or switching to another protocol - require a significant system-design effort and replacement of hardware and software. This has paved the way for CAN Flexible Data-rate (CAN FD), which extends the CAN standard and permits significantly higher data rates, enabling faster firmware upgrades. However, some changes must be made like: exchange the classical CAN microcontroller with a CAN FD microcontroller and also a CAN FD transceiver must be used.</div><div class="htmlview paragraph">This article will explore the benefits of CAN FD, how it compares with the classical CAN protocol, requirements for systems and how to introduce CAN FD into existing CAN networks.</div></div>

As de facto standards of in-vehicle network communications among various ECUs (Electronic Control Units), CAN (Controller Area Network) protocols invented by Bosch rely on the privately-defined unique identifiers CAN ID in CAN messages which do not convey any destination address. On the other hand, sticking to error handling mechanisms in CAN protocols, an ECU with an amount of transmission errors would enter bus-off state (i.e., go offline thereupon) and shall be recovered according to some prescribed bus-off recovery mode (BOM). All these sensitive CAN knowledge concealed inside an ECU by OEMs (Original Equipment Manufacturers) shall not be revealed and could be found extensive practical applications to both adversarial behavior (e.g., target ECU attacks) and security enhancement mechanisms (e.g., intrusion detection system designs). The paper presents FirmCAN, the first automatic analysis framework to dope out sensitive CAN knowledge (CAN IDs and bus-off recovery mode in particular) compiled in automotive ECU firmwares. FirmCAN first identifies base address (using accurate absolute function entry addresses), and then performs CAN module API positioning and sensitive configuration information resolution. We buckle down to automotive ECUs that resort to fixed-address mailboxes as CAN module transmission buffers (e.g., Renesas SuperH/RA series) and present concrete algorithms for each analysis phase. Our experimental evaluations first investigate firmwares extracted from real automotive ECUs. We then develop our own applications using RA6M4 development boards, which not only produce required firmwares to evaluate FirmCAN, but also create ground truth through hardware debugging. All evaluations demonstrate that FirmCAN can accurately garner above-mentioned sensitive CAN knowledge. FirmCAN can be trivially generalized to engage in extended frames and CAN modules with similar transmission logic, e.g., TI (Texas Instruments), ST (ST Microelectronics), etc.

Abstract- Modern vehicles use the Electronics Control Unit (ECU) to control and monitor all the activities within the vehicle. The number of ECUs are increasing as the complexity of vehicles increases. All the ECUs present in the vehicles are communicated with each other via CAN protocol. Any malfunction in the ECU or abnormal behaviour of ECU is detected or understood by diagnostic services. CAN Protocol does not have advanced features like Diagnostic. The CAN protocol covers only the Physical and Data link layer of the OSI model. There is a need for a standardised diagnostic protocol which can use CAN as underlying technology. Standardised diagnostic protocols used in the automotive domain are On Board Diagnostics (OBD) and Unified Diagnostic services (UDS). UDS protocol is defined under the ISO 14229 standard and provides a standardized framework for in-vehicle communication and fault diagnosis. This project focuses on the design and implementation of the UDS protocol on an embedded system using STM32F407 microcontrollers. The project involves developing a diagnostic communication system between Electronic Control Units (ECUs) Light Control Module (LCM) and Tester tool connected over a CAN bus. Keywords- Unified Diagnostic Services (UDS), ISO 14229, Electronic Control Unit (ECU), Body Control Module (BCM), Light Control Module (LCM), Controller Area Network (CAN), Diagnostic Trouble Code (DTC), Routine Control Identifier (RID), Data Identifier (DID), ISO-TP (Transport Protocol)

Modern vehicles contain a few controller area networks (CANs), which allow scores of on-board electronic control units (ECUs) to communicate messages critical to vehicle functions and driver safety. provides a lightweight and reliable broadcast protocol but is bereft of security features. As evidenced by many recent research works, exploits are possible both remotely and with direct access, fueling a growing intrusion detection system (IDS) body of research. A challenge for pioneering vehicle-agnostic IDSs is that passenger vehicles' message encodings are proprietary, defined and held secret by original equipment manufacturers (OEMs). Targeting detection of next-generation attacks, in which messages are sent from the expected ECU at the expected time but with malicious content, researchers are now seeking to leverage CAN data models'', which predict future messages and use prediction error to identify anomalous, hopefully malicious messages. Yet, current works model signals post-translation, i.e., after applying OEM-donated or reverse-engineered translations from raw data. We present initial IDS results testing deep neural networks used to predict data at the bit level, targeting IDS capabilities that avoiding reverse engineering proprietary encodings. Our results suggest the method is promising for data with signals exhibiting dependence on previous or concurrent inputs.

As connectivity between and within vehicles increases, so does concern about safety and security. Various automotive serial protocols are used inside vehicles such as Controller Area Network (CAN), Local Interconnect Network (LIN), and FlexRay. CAN Bus is the most used in-vehicle network protocol to support exchange of vehicle parameters between Electronic Control Units (ECUs). This protocol lacks security mechanisms by design and is therefore vulnerable to various attacks. Furthermore, connectivity of vehicles has made the CAN Bus vulnerable not only from within the vehicle but also from outside. With the rise of connected cars, more entry points and interfaces have been introduced on board vehicles, thereby also leading to a wider potential attack surface. Existing security mechanisms focus on the use of encryption, authentication, and vehicle Intrusion Detection Systems (IDS), which operate under various constraints such as low bandwidth, small frame size (e.g., in the CAN protocol), limited availability of computational resources, and real-time sensitivity. We survey and classify current cryptographic and IDS approaches and compare these approaches based on criteria such as real-time constraints, types of hardware used, changes in CAN Bus behaviour, types of attack mitigation, and software/ hardware used to validate these approaches. We conclude with mitigation strategies limitations and research challenges for the future.

Vehicle-IT convergence technology is a rapidly rising paradigm of modern vehicles, in which an electronic control unit (ECU) is used to control the vehicle electrical systems, and the controller area network (CAN), an in-vehicle network, is commonly used to construct an efficient network of ECUs. Unfortunately, security issues have not been treated properly in CAN, although CAN control messages could be life-critical. With the appearance of the connected car environment, in-vehicle networks (e.g., CAN) are now connected to external networks (e.g., 3G/4G mobile networks), enabling an adversary to perform a long-range wireless attack using CAN vulnerabilities. In this paper we show that a long-range wireless attack is physically possible using a real vehicle and malicious smartphone application in a connected car environment. We also propose a security protocol for CAN as a countermeasure designed in accordance with current CAN specifications. We evaluate the feasibility of the proposed security protocol using CANoe software and a DSP-F28335 microcontroller. Our results show that the proposed security protocol is more efficient than existing security protocols with respect to authentication delay and communication load.

The controller area network (CAN) protocol is the most widely used in-vehicle network because it provides bounded transmission delay among electronic control units (ECUs) at data rates between 125Kbps and 1Mbps. And, many automotive companies have chosen the CAN protocol for their in-vehicle networking (IVN) system such as chassis network system of intelligent vehicles because of its excellent communication characteristics. However, the increasing number of ECUs and the need for more intelligent functions of advanced driver assistance systems (ADASs) or in-vehicle information systems (IVISs) require a network with more network capacity and real-time quality-of-service (QoS). As one approach to enhancing the network capacity of a CAN system, this paper introduces a CAN system with dual communication channel. And, this paper presents message allocation algorithm that allocates messages to the more appropriate channel using forecast traffic of each channel. An experimental testbed using commercial off-the-shelf microcontrollers with two CAN controllers was used to demonstrate the feasibility of the CAN system with dual communication channel using message allocation algorithm.

Controller Area Networks (CANs) are critical components of modern vehicles and industrial systems, facilitating communication between various electronic control units. However, the widespread connectivity and lack of inherent security measures make CANs vulnerable to cyber-attacks. Intrusion detection systems (IDS) safeguard CANs by detecting and mitigating potential attacks. This paper presents a comprehensive analysis of current methods for the real-time detection of attacks in CANs. The IDSs based on different input data modalities are evaluated based on their effectiveness, accuracy, and efficiency. The analysis highlights the strengths and limitations of each method, providing valuable insights for researchers and practitioners in developing robust and reliable intrusion detection systems for CANs. The findings suggest that the lightweight strategy in IDS is widely accepted for real-time application due to its computational simplicity and model structure. Furthermore, the paper identifies future directions to enhance the security of CANs and ensure their resilience against evolving threats.

The modern car is increasingly connected. That connection is magnified by the presence of a large number of electronic control units (ECUs). The communication between the ECUs of a modern car is assured by the Controller Area Network (CAN) bus system. Despite its importance, the CAN bus system is bereft of security mechanisms making it vulnerable to numerous security attacks. When an attacker succeeds in compromising the ECUs, they can take control and stop the engine, disable the brakes, turn the lights on/off, etc. An intrusion detection system (IDS) can be deployed as an appropriate security measure to detect the malicious network traffic in the CAN bus system. In this paper, we propose a Convolutional Neural Network (CNN)-based network attacks IDS for protecting the CAN bus system. For efficiency reasons, we generated our own datasets from three car models. Our experiment results demonstrate that our classifier is efficient for detecting the CAN bus system attacks, and it performs with a high accuracy of 99.99% and a detection rate of 0.99.

В статье представлено развитие сигнатурного подхода обнаружения вторжений на основе кластеризации и дерева решений. Также предложен оригинальный способ разработки аномального подхода к обнаружению вторжений, разработана модель функционирования гибридной системы обнаружения вторжений, отличающаяся от известных большей точностью обнаружения, меньшим процентом ложных тревог, приоритезацией сетевых пакетов для анализа, а также решающей основные недостатки аномального и сигнатурного подхода. Introduction: Alongside the development of the Internet, network security has become a crucial requirement. Bugs in software and operating systems result in an increasing number of previously unknown intrusions discovered every day. The harm caused by these intrusions is becoming more and more dangerous. Firewalls can't ensure a complete protection of the network, because they prevent external threats and don't maintain internal attacks. Intrusion detection systems (IDS) solve this problem. The aim of the research is to develop a model of a hybrid intrusion detection system that will use a combination of improved detection methods based on anomalous and signature approach to increase detection accuracy and reduce the level of false alarms. Tasks: development of an improvement for the signature detection method, development of a unique anomaly detection method, development of a unique hybrid model of the intrusion detection system. Methods. To improve the signature detection method, we used machine learning, in particular the C5 algorithm, as well as decision trees. In addition to this, there are presented: storing signature rules with their partial structure in the MongoDB database, the process of clustering rules, building and detecting with the use of a decision tree. There are presented a unique method for detecting anomalies in network traffic with the use of machine learning methods and the theory of finite automata. Besides, there are shown: the detection process with the use of the sliding window technique, machine learning and time automaton; storage of trained models in the MongoDB database, the process of loading anomalies into the signature database with the use of RabbitMQ. Findings. The hybrid IDS with increased detection accuracy and reduced false alarm rate was developed. The developed system was compared with the well-known open-source solutions Snort and Suricata. The signature detection method was improved with machine learning and decision trees, and a unique anomaly detection method that uses machine learning and a time automaton was presented. It allows to detect previously unknown attacks. The practical significance of the work is the partial implementation of the developed system for the Infologistik24 LLC company.

Controller Area Network (CAN) is an in-vehicle communication protocol which provides an efficient and reliable communication link between Electronic Control Units (ECUs) in real-time. Recent studies have shown that attackers can take remote control of the targeted car by exploiting the vulnerabilities of the CAN protocol. Motivated by this fact, we propose Clock Offset-based Intrusion Detection System (COIDS) to monitor in-vehicle network and detect any intrusion. Precisely, we first measure and then exploit the clock offset of transmitter ECU's clock for fingerprinting ECU. We next leverage the derived fingerprints to construct a baseline of ECU's normal clock behaviour using an active learning technique. Based on the baseline of normal behaviour, we use Cumulative Sum method to detect any abnormal deviation in clock offset. Particularly, if the deviation in clock offset exceeds an unexpected positive or negative value, COIDS declares this change as an intrusion. Further, we use sequential change-point detection technique to determine the exact time of intrusion. We perform exhaustive experiments on real-world publicly available datasets primarily to assess the effectiveness of COIDS against three most potential attacks on CAN, i.e., DoS, impersonation and fuzzy attacks. The results show that COIDS is highly effective in defending all these three attacks. Further, the results show that COIDS considerably faster in detecting intrusion compared to a state-of-the-art solution.

This paper presents a new configuration for in-vehicle networks to increase the reliability of the communication between electronic control units (ECU) and to improve the safety level of a vehicle. Basically, the CAN (Controller Area Network) protocol is assumed for the data communication in vehicles but more reliable communication can be guaranteed by adding the ZigBee communication function to each ECU. To show the validity and the performance of the presented network configuration for some network faults, the Electronic Stability Control (ESC) operation is analyzed by using an ECU-In-the-Loop Simulation (EILS). The experimental set-up for EILS of ESC system consists of two 32-bit microcontroller boards which can be communicated with the CAN or the ZigBee protocol. A 7-DOF (Degrees Of Freedom) vehicle model and ESC algorithm is implemented on each microcontroller. It is shown by the experimental results that ESC using the high reliability CAN system can achieve the same performance as using only CAN protocol without disconnected CAN bus.KeywordsIn-vehicle networkController area networkReliabilityFault toleranceElectronic stability control

The Controller Area Network (CAN) bus system works inside connected cars as a central system for communication between electronic control units (ECUs). Despite its central importance, the CAN does not support an authentication mechanism, i.e., CAN messages are broadcast without basic security features. As a result, it is easy for attackers to launch attacks at the CAN bus network system. Attackers can compromise the CAN bus system in several ways: denial of service, fuzzing, spoofing, etc. It is imperative to devise methodologies to protect modern cars against the aforementioned attacks. In this paper, we propose a Long Short-Term Memory (LSTM)-based Intrusion Detection System (IDS) to detect and mitigate the CAN bus network attacks. We first inject attacks at the CAN bus system in a car that we have at our disposal to generate the attack dataset, which we use to test and train our model. Our results demonstrate that our classifier is efficient in detecting the CAN attacks. We achieved a detection accuracy of 99.9949%.