Abnormal Message Detection for CAN Bus Based on Message Transmission Behaviors

Kang, Liuwang; Shen, Haiying

doi:10.1109/icdcs47774.2020.00041

Cited by 3 publications

(2 citation statements)

References 20 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Existing IDSs are basically divided into neural network methods [14,[21][22][23][24][25][26][27][28][29][30], traditional machine learning methods [31][32][33][34][35], and other efficient statistics methods that utilize the characteristics of the CAN bus [10,13,26,[36][37][38][39][40][41][42][43][44][45][46]. In the methods related to neural networks, as in Refs.…”

Section: Related Workmentioning

confidence: 99%

“…In contrast, the time and space complexity of traditional machine learning and other methods that utilize the characteristics of the bus is not very high, which is more practical and can be used in real vehicles. Kang et al [37] find that the ID has a certain fixed pattern between the loops of an ID. When the car is attacked, the injected data change the inherent pattern between the ID loops.…”

Section: Related Workmentioning

confidence: 99%

See 1 more Smart Citation

Windowed Hamming Distance-Based Intrusion Detection for the CAN Bus

Fang,

Zhang,

et al. 2024

Applied Sciences

View full text Add to dashboard Cite

The use of a Controller Area Network (CAN) bus in the automotive industry for connecting electronic control units (ECUs) poses security vulnerabilities due to the lack of built-in security features. Intrusion Detection Systems (IDSs) have emerged as a practical solution for safeguarding the CAN bus. However, developing an effective IDS for in-vehicle CAN buses encounters challenges in achieving high precision for detecting attacks and meeting real-time requirements with limited computational resources. To address these challenges, we propose a novel method for anomaly detection on CAN data using windowed Hamming distance. Our approach utilizes sliding windows and Hamming distance to extract features from time series data. By creating benchmark windows that span at least one cycle of data, we compare newly generated windows with recorded benchmarks using the Hamming distance to identify abnormal CAN messages. During the experimental phase, we conduct extensive testing on both the public car-hack dataset and a proprietary dataset. The experimental results indicate that our method achieves an impressive accuracy of up to 99.67% in detecting Denial of Service (DoS) attacks and an accuracy of 98.66% for fuzzing attacks. In terms of two types of spoofing attacks, our method achieves detection accuracies of 99.48% and 99.61%, respectively, significantly outperforming the methods relying solely on the Hamming distance. Furthermore, in terms of detection time, our method significantly reduces the time consumption by nearly 20-fold compared to the approach using deep convolutional neural networks (DCNN), decreasing it from 6.7 ms to 0.37 ms.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Windowed Hamming Distance-Based Intrusion Detection for the CAN Bus

Fang,

Zhang,

et al. 2024

Applied Sciences

View full text Add to dashboard Cite

show abstract

Systematic Review on the Recent Trends of Cybersecurity in Automobile Industry

Eze,

Emmanuel,

Onietan

et al. 2023

2023 International Conference on Science, Engineering and Business for Sustainable Development Goals (SEB-SDG)

View full text Add to dashboard Cite

GAN model using field fuzz mutation for in-vehicle CAN bus intrusion detection

Jiang

Liu

et al. 2022

MBE

View full text Add to dashboard Cite

<abstract> <p>Controller area network (CAN) are widely used in smart vehicles to realize information interactions between electronic control units and other devices in vehicles. Owing to an increase in external communication interfaces, the cybersecurity of in-vehicle CAN bus networks is threatened. In-vehicle CAN intrusion detection systems with high detection rates and low false-negative rates have become important security protection measures for automotive networks. The boundary of the current machine learning-based in-vehicle CAN bus intrusion detection algorithm to determine the anomalous behavior triggered by CAN messages is unclear, and a validity check is required after the intrusion detection algorithm is designed. To solve the low coverage rate problem in the process of validating intrusion detection algorithms, an in-vehicle CAN fuzz-testing message generation model, the field-associative mutation generation adversarial network (FAMGAN), is proposed. To improve the defects of high randomness in generating messages in traditional fuzz-testing algorithms, FAMGAN adopts field division based on a conditional random field and the field association method based on the Apriori algorithm. Experiments were conducted on a real car using a code-built intrusion detection algorithm. The results demonstrate that FAMGAN can efficiently generate anomalous CAN messages and evaluate the performance of an in-vehicle CAN intrusion detection algorithm.</p> </abstract>

show abstract

Abnormal Message Detection for CAN Bus Based on Message Transmission Behaviors

Cited by 3 publications

References 20 publications

Windowed Hamming Distance-Based Intrusion Detection for the CAN Bus

Windowed Hamming Distance-Based Intrusion Detection for the CAN Bus

Systematic Review on the Recent Trends of Cybersecurity in Automobile Industry

GAN model using field fuzz mutation for in-vehicle CAN bus intrusion detection

Contact Info

Product

Resources

About