Exploiting the Shape of CAN Data for In-Vehicle Intrusion Detection

Abstract

Modern vehicles rely on scores of electronic control units (ECUs) broadcasting messages over a few controller area networks (CANs). Bereft of security features, in-vehicle CANs are exposed to cyber manipulation and multiple researches have proved viable, life-threatening cyber attacks. Complicating the issue, CAN messages lack a common mapping of functions to commands, so packets are observable but not easily decipherable. We present a transformational approach to CAN IDS that exploits the geometric properties of CAN data to inform two novel detectors-one based on distance from a learned, lower dimensional manifold and the other on discontinuities of the manifold over time. Proof-of-concept tests are presented by implementing a potential attack approach on a driving vehicle. The initial results suggest that (1) the first detector requires additional refinement but does hold promise; (2) the second detector gives a clear, strong indicator of the attack; and (3) the algorithms keep pace with high-speed CAN messages. As our approach is data-driven it provides a vehicle-agnostic IDS that eliminates the need to reverse engineer CAN messages and can be ported to an after-market plugin.

Towards a CAN IDS Based on a Neural Network Data Field Predictor

“…CAN IDS research into unsupervised learning methodologies for detecting malicious messages has begun modeling correlations inherent to the CAN data that are broken by attacks. Tyree et al [23] propose a manifold learning technique to identify relationships in CAN data that are broken during attacks that do not coordinate related signals. Their technique requires at least the ability to tokenize (partition) the up-to 64-bit CAN data fields into signal-sized messages but not fully translate the CAN data.…”

GovMath

“…Attacks that seek to change vehicle states abruptly may manipulate the messages in an unexpected and discontinuous way. To test this hypothesis, we employed manifold learning techniques to learn a lower dimensional representation of CAN data and found that testing on emulated attacks shows a discontinuous jump in the lower dimensional representation providing a novel avenue for detection [Tyree, et al 2018]. The above method is a "black box" method (knowing nothing of the data's meaning, but identifying correlations mathematically), which detracts from interpretability.…”

ACTT: Automotive CAN Tokenization and Translation

“…Some research opts for handlabeled drive states (i.e accelerate, reverse, key in, speedometer reading of 20mph, ect.) [7][8][9], while others used external data loggers [10].…”

“…Others implemented machine learning methods (Hidden Markov Models, Neural Nets, Manifold Learning, etc.) that implicitly learn relationships between raw binary data and vehicular states [7][8][9][10][16][17][18].…”