Shape of the Cloak: Formal Analysis of Clock Skew-Based Intrusion Detection System in Controller Area Networks

Abstract

This paper presents a new masquerade attack called the cloaking attack and provides formal analyses for clock skewbased Intrusion Detection Systems (IDSs) that detect masquerade attacks in the Controller Area Network (CAN) in automobiles. In the cloaking attack, the adversary manipulates the message inter-transmission times of spoofed messages by adding delays so as to emulate a desired clock skew and avoid detection. In order to predict and characterize the impact of the cloaking attack in terms of the attack success probability on a given CAN bus and IDS, we develop formal models for two clock skew-based IDSs, i.e., the state-of-the-art (SOTA) IDS and its adaptation to the widely used Network Time Protocol (NTP), using parameters of the attacker, the detector, and the hardware platform. To the best of our knowledge, this is the first paper that provides formal analyses of clock skew-based IDSs in automotive CAN. We implement the cloaking attack on two hardware testbeds, a prototype and a real vehicle (the University of Washington (UW) EcoCAR), and demonstrate its effectiveness against both the SOTA and NTP-based IDSs. We validate our formal analyses through extensive experiments for different messages, IDS settings, and vehicles. By comparing each predicted attack success probability curve against its experimental curve, we find that the average prediction error is within 3.0% for the SOTA IDS and 5.7% for the NTP-based IDS.

Clock-Based Sender Identification and Attack Detection for Automotive CAN Network

“…Ji et al [35] evaluate the performance of clock skew-based detection method compared with information entropy detection algorithm. However, the estimation process of clock skew as discussed above can be easily compromised by modifying the transmission of frames as demonstrated in [24]. Besides, Kulandaivel et al [22] point out that the calculation process of clock skew proposed in [14] can be affected by the period of CAN frames.…”

“…Besides voltage, the timing of signal is another physical characteristic which can be exploited for automotive IDS. The fundamental of approaches [14], [22]- [24] is based on the fact that the clock skew exists in the clocks of different ECUs which is unique and stable thus can be exploited as fingerprint to detect attack and pinpoint the source sender in automotive networks. The clock skew represents the difference in frequency among different ECUs.…”

Soft-computing-based false alarm reduction for hierarchical data of intrusion detection system

“…Here, the author extracted functional vector and used in both the IDS with the one-class support vector machine (OCSVM) kernel (radial basis function (RBF)) and other IDSs 9,15 in a similar way. Ying et al 17 presented an IDS for cloaking attack with clock skewbased IDS as a solution for controller area network.…”

Tacan

“…In order to evaluate the bit error ratio of IAT-based covert channels on real vehicles, we collected data for six representative messages (including message 0x180 that was transmitted from the testbed ECU) with different ID levels, periods, and noise levels from the Toyota Camry [8] and the UW EcoCAR [10], as shown in Table 2. The same EcoCAR dataset was used in [35]. Note that IAT noise is quantified in terms of the standard deviation (normalized by the period) and the range (the difference between the maximum IAT and the minimum IAT, normalized by the period).…”

“…The timing-based IDS in [5] exploits CAN message periodicity to estimate clock skew as a unique fingerprint to detect masquerade attacks. Nevertheless, it was later shown to be ineffective against the cloaking attack that modifies the inter-transmission time to emulate the clock skew of the targeted ECU [28,35]. The voltage-based IDSs [6,7,17,24] attempt to fingerprint the attacker through voltage signal characteristics.…”