Search

Controller Area Network (CAN) is a de facto standard of in-vehicle networks. Since CAN employs broadcast communication and a slower network than other general networks (e.g. Ethernet, IEEE802.11), it is inherently vulnerable to Denial-of-Service (DoS) attacks. As a countermeasure against DoS attacks on CAN, a method for detecting a DoS attack using the entropy in a sliding window has been proposed.Thismethodhasagoodadvantageintermsofeffectivenessandthesmallcomputationaloverhead. However, this method may only be effective against DoS attacks under naive conditions such as some higher priority messages. In addition, if an adversary can adjust the entropy of the DoS attack to its normal value, the conventional method cannot detect a DoS attack in which the adversary manipulates the entropy. We found this type of DoS attack, which is called an entropy-manipulated attack. In this paper, we propose a method that can detect an entropy-manipulated attack by using the similarity of two sliding windows. We confirmed that the proposed method detected the DoS attack in 100% of the cases in our experiment, and we showed that the detection time is up to 93% (14 µs) shorter than the conventional method.

The number of computer controlled vehicles throughout the world is rising at a staggering speed. Even though this enhances the driving experience, it opens a new security hole in the automotive industry. To alleviate this issue, we are proposing an intrusion detection system (IDS) to the controller area network (CAN), which is the de facto communication standard of present-day vehicles. We implemented an IDS based on the analysis of ID sequences. The IDS uses a trained Long-Short Term Memory (LSTM) to predict an arbitration ID that will appear in the future by looking back to the last 20 packet arbitration IDs. The output from the LSTM network is a softmax probability of all the 42 arbitration IDs in our test car. The softmax probability is used in two approaches for IDS. In the first approach, a single arbitration ID is predicted by taking the class which has the highest softmax probability. This method only gave us an accuracy of 0.6. Applying this result in a real vehicle would give us a lot of false negatives, hence we devised a second approach that uses log loss as an anomaly signal. The evaluated log loss is compared with a predefined threshold to see if the result is in the anomaly boundary. Furthermore, We have tested our approach using insertion, drop and illegal ID attacks which greatly outperform the conventional method with practical F1 scores of 0.9, 0.84, and 1.0 respectively., 2020 IEEE International Conference on Pervasive Computing and Communications Workshops (PerCom Workshops),23-27 March 2020,Austin, TX, USA, USA

application/pdf, Controller Area Network (CAN) is a de facto standard of in-vehicle networks. Since CAN employs broadcast communication and a slower network than other general networks (e.g. Ethernet, IEEE802.11), it is inherently vulnerable to Denial-of-Service (DoS) attacks. As a countermeasure against DoS attacks on CAN, a method for detecting a DoS attack using the entropy in a sliding window has been proposed.Thismethodhasagoodadvantageintermsofeffectivenessandthesmallcomputationaloverhead. However, this method may only be effective against DoS attacks under naive conditions such as some higher priority messages. In addition, if an adversary can adjust the entropy of the DoS attack to its normal value, the conventional method cannot detect a DoS attack in which the adversary manipulates the entropy. We found this type of DoS attack, which is called an entropy-manipulated attack. In this paper, we propose a method that can detect an entropy-manipulated attack by using the similarity of two sliding windows. We confirmed that the proposed method detected the DoS attack in 100% of the cases in our experiment, and we showed that the detection time is up to 93% (14 µs) shorter than the conventional method., journal article

The number of computer controlled vehicles throughout the world is rising at a staggering speed. Even though this enhances the driving experience, it opens a new security hole in the automotive industry. To alleviate this issue, we are proposing an intrusion detection system (IDS) to the controller area network (CAN), which is the de facto communication standard of present-day vehicles. We implemented an IDS based on the analysis of ID sequences. The IDS uses a trained Long-Short Term Memory (LSTM) to predict an arbitration ID that will appear in the future by looking back to the last 20 packet arbitration IDs. The output from the LSTM network is a softmax probability of all the 42 arbitration IDs in our test car. The softmax probability is used in two approaches for IDS. In the first approach, a single arbitration ID is predicted by taking the class which has the highest softmax probability. This method only gave us an accuracy of 0.6. Applying this result in a real vehicle would give us a lot of false negatives, hence we devised a second approach that uses log loss as an anomaly signal. The evaluated log loss is compared with a predefined threshold to see if the result is in the anomaly boundary. Furthermore, We have tested our approach using insertion, drop and illegal ID attacks which greatly outperform the conventional method with practical F1 scores of 0.9, 0.84, and 1.0 respectively.