Identifying ECUs Using Inimitable Characteristics of Signals in Controller Area Networks

Abstract

In the last several decades, the automotive industry has come to incorporate the latest Information and Communications (ICT) technology, increasingly replacing mechanical components of vehicles with electronic components. These electronic control units (ECUs) communicate with each other in an invehicle network that makes the vehicle both safer and easier to drive. Controller Area Networks (CANs) are the current standard for such high quality in-vehicle communication. Unfortunately, however, CANs do not currently offer protection against security attacks. In particular, they do not allow for message authentication and hence are open to attacks that replay ECU messages for malicious purposes. Applying the classic cryptographic method of message authentication code (MAC) is not feasible since the CAN data frame is not long enough to include a sufficiently long MAC to provide effective authentication. In this paper, we propose a novel identification method, which works in the physical layer of an in-vehicle CAN network. Our method identifies ECUs using inimitable characteristics of signals enabling detection of a compromised or alien ECU being used in a replay attack. Unlike previous attempts to address security issues in the in-vehicle CAN network, our method works by simply adding a monitoring unit to the existing network, making it deployable in current systems and compliant with required CAN standards. Our experimental results show that the bit string and classification algorithm that we utilized yielded more accurate identification of compromised ECUs than any other method proposed to date. The false positive rate is more than 2 times lower than the method proposed by P.-S. Murvay et al. This paper is also the first to identify potential attack models that systems should be able to detect.

Exploiting the Shape of CAN Data for In-Vehicle Intrusion Detection

“…The attack data capture is hosted over a period of 70s. Malicious traffic is injected in three 10s intervals, roughly [10,20], [30,40], [50,60]. Fig.…”

“…(No sender/receiver information is included in CAN packets). These detectors use datadriven techniques to classify which ECU sent each message by exploiting timing or voltage signatures [18][19][20]. These can detect signals that originate from the wrong transmitter.…”

CAN Radar: Sensing Physical Devices in CAN Networks based on Time Domain Reflectometry

“…Kneib and Huth developed Scission [10] which also uses physical characteristics (analog values) that belong to the CAN frame to recognize a participant. Scission improves the approach from Choi et al [9] due to minimizing resource requirements. The researcher have reduced the sampling rate by a factor of 125 as well as replaced the neural network engine with a logistic regression.…”

“…The authors Choi et al [9] present a method to identify ECUs by using signal characteristics of transmitted CAN messages. They propose different statistical features based on time and frequency for the measured signals.…”

“…On the other hand, behaviourbased approaches are able to identify such unknown attacks due to consideration of unusual behaviour in the information flow of transmission channels. There are already behaviourbased approaches for the CAN bus which use deviations from physical characteristics (voltage, current or frequency) of transmitted messages as identification criteria [8], [9], [10], [11]. These approaches require a synchronization property like the Acknowledgement (ACK) bit or static sections of the CAN frame.…”