Network Anomaly Detection in Cars based on Time-Sensitive Ingress Control

Abstract

Connected cars are vulnerable to cyber attacks. Security challenges arise from vehicular management uplinks, from signaling with roadside units or nearby cars, as well as from common Internet services. Major threats arrive from bogus traffic that enters the in-car backbone, which will comprise of Ethernet technologies in the near future. Various security techniques from different areas and layers are under discussion to protect future vehicles. In this paper, we show how Per-Stream Filtering and Policing of IEEE Time-Sensitive Networking (TSN) can be used as a core technology for identifying misbehaving traffic flows in cars, and thereby serve as network anomaly detectors. TSN is the leading candidate for implementing quality of service in vehicular Ethernet backbones. We classify the impact of network attacks on traffic flows and benchmark the detection performance in each individual class. Based on a backbone topology derived from a real car and its traffic definition, we evaluate the detection system in realistic scenarios with real attack traces. Our results show that the detection accuracy depends on the precision of the in-vehicle communication specification, the traffic type, the corruption layer, and the attack impact on the link layer. Most notably, the anomaly indicators of our approach remain free of false positive alarms, which is an important foundation for implementing automated countermeasures in future vehicles.

Automotive Ethernet architecture and security: challenges and technologies

“…2. The IVN fields and their subjects in the reviewed works Field Paper(s) Subjects Requirements of automotive TSN [6], [11], [12] List of requirements for future IVN processing platforms [13], [14] Integrate TSN with SDN with security [15] NDN [16] Graceful degradation for real-time autonomous vehicle applications [17] Improve the accuracy of the canvas [10] Reducing latency by porting it to Xronos [18] TSN-5G heterogeneous networks [19] HPVUs security [20] OTT Ethernet algorithm [21] Ethernet backbone with Zone based architecture [22] iDriving [45], [46] TSN PSFP, Protection of the TSN automotive Ethernet Security protocols for IVN [23], [24], [30], [35], [39] Review of blockchain and security attributes of IVN [34] IPSEC [36] Extensions to the SOME/IP protocol for securing SOME/IP service discovery [37] CANFD [25]- [29], [33], [38] Confidentiality, authentication, integrity [30]- [33] Blockchain in IVN [40] Structure-aware CAN Fuzzing procedure [41] Mitigations against an underactuated USV Intrusions detection systems for IVN [29], [42], [44], [47], [48], [53] Intrusion Detection Systems [49], …”

“…The TSN per-stream filtering and policing (PSFP) can be utilized as a fundamental technology for detecting malicious traffic flows in vehicles, and in this manner provide network anomaly detectors services as explained by Meyer et al [45]. They evaluated the detection systems based on backbone topology derived from a real vehicle and their traffic classification; their results showed that the detection accuracy depends on some factors such as: the corruption layer, the traffic type.…”

IEEE 802.1 Zaman Hassas Araç-İçi Haberleşme Ağları için Siber Güvenlik: Güncel Gelişmeler ve Hizmet Reddi Saldırılarının Etki Analizi

“…Emphasizing that the original specification for CAN lacks a central monitoring mechanism, Häckel et al [45] offers an architecture integrating TSN and SDN, in which all real-time traffic transmitted in an in-vehicle network is centrally monitored without increasing the network delay in order to prevent malicious traffic. Meyer et al [46] performs anomaly detection by using TSN and SDN technologies together in an invehicle communication network, which relies on the filtering capabilities of Per-Stream Filtering and Policing (PSFP) specified [47] proposes an anomaly detection system for invehicle networks with TSN support relying on PSFP specified in 802.1Qci in order to block the messages exceeding a customized maximum service data unit size. The authors experimentally show that the proposed system successfully identifies four different abnormal traffic events in relation with DoS attacks.…”

Secure Time-Sensitive Software-Defined Networking in Vehicles

“…Anomaly detection can identify ongoing attacks in the network [39], e.g., using machine learning algorithms to detect anomalies on the CAN bus [40]. In previous work [41], we Fig. 2: Integrated network architecture of TSN and SDN.…”