Detection of Message Injection Attacks Onto the CAN Bus Using Similarities of Successive Messages-Sequence Graphs

Abstract

The smart features of modern cars are enabled by a number of Electronic Control Units (ECUs) components that communicate through an in-vehicle network, known as Controller Area Network (CAN) bus. The fundamental challenge is the security of the communication link where an attacker can inject messages (e.g., increase the speed) that may impact the safety of the driver. Most of existing practical IDS solutions rely on the knowledge of the identity of the ECUs, which is proprietary information. This paper proposes a message injection attack detection solution that is independent of the IDs of the ECUs. First, we represent the sequencing of the messages in a given time-interval as a direct graph and compute the similarities of the successive graphs using the cosine similarity and Pearson correlation. Then, we apply threshold, change point detection, and Long Short-Term Memory (LSTM)-Recurrent Neural Network (RNN) to detect and predict malicious message injections into the CAN bus. The evaluation of the methods using a dataset collected from a moving vehicle under malicious RPM and speed reading message injections show a detection accuracy of 97.32% and detection speed of 2.5 milliseconds when using a threshold method. The performance metrics makes the IDS suitable for real-time control mechanisms for vehicle resiliency to cyber attacks.

Evaluation of the Architecture Alternatives for Real-time Intrusion Detection Systems for Connected Vehicles

“…The detection accuracy of cosine graphsimilarity threshold reaches 97.32% of accuracy and the detection speed of 2.5 milliseconds. Unlike most MLbased studies in the literature, the technique proposed in [11] neither depend on the make or model of the car nor its proprietary information (i.e., CAN ID).…”

“…Attackers take control of a connected vehicle by injecting messages into its CAN bus. To mitigate such attacks, we have developed an ML-based IDS that captures the pattern of the sequences of the CAN messages and represent them with a directed graph, which we call Messages-Sequence Graph (MSG), where the nodes represent the CAN IDs of the messages and the edges represent the sequences order of the messages, as depicted by Figure 3 [11].…”

“…We consider that a MSG representing the w messages exchanged in a CAN bus at time t is similar to the MSG representing the w CAN messages exchanged during the following time slot t + 1 in the case of normal driving behavior and that injection of messages into the CAN bus disrupts this pattern [11]-see Figure 3 [11]. Fig.…”

“…In addition, Table II enumerates a set of constraints that the architecture shall satisfy. Since the goal of this paper is to assess architectures of real-time IDS, we use the existing anomaly detection module developed in previous work [11] and do not create new ones. To satisfy the first requirement, we implement the CAN Bus monitor and the anomaly detection engine using the C language.…”

“…Neural Networks (NN) has been the commonly used ML-based approach for designing IDSs for the CAN bus, e.g., [20], [21], [22], [23]. In previous work [10], [11] we used machine learning techniques to develop IDSs for connected vehicles including Hodden Markov Model (HMM), Long Short-Term Memory (LSTM), cosine graph-similarity, and change-point detection and evaluated them using CAN data extracted from a moving vehicle under malicious RPM and speed readings messages injections into the in-vehicle network of the vehicles. The detection accuracy of cosine graphsimilarity threshold reaches 97.32% of accuracy and the detection speed of 2.5 milliseconds.…”