Towards a CAN IDS Based on a Neural Network Data Field Predictor

Abstract

Modern vehicles contain a few controller area networks (CANs), which allow scores of on-board electronic control units (ECUs) to communicate messages critical to vehicle functions and driver safety. CAN provides a lightweight and reliable broadcast protocol but is bereft of security features. As evidenced by many recent research works, CAN exploits are possible both remotely and with direct access, fueling a growing CAN intrusion detection system (IDS) body of research. A challenge for pioneering vehicle-agnostic IDSs is that passenger vehicles' CAN message encodings are proprietary, defined and held secret by original equipment manufacturers (OEMs). Targeting detection of next-generation attacks, in which messages are sent from the expected ECU at the expected time but with malicious content, researchers are now seeking to leverage "CAN data models", which predict future CAN messages and use prediction error to identify anomalous, hopefully malicious CAN messages. Yet, current works model CAN signals post-translation, i.e., after applying OEM-donated or reverse-engineered translations from raw data. We present initial IDS results testing deep neural networks used to predict CAN data at the bit level, targeting IDS capabilities that avoiding reverse engineering proprietary encodings. Our results suggest the method is promising for data with signals exhibiting dependence on previous or concurrent inputs.

STC-IDS: Spatial-Temporal Correlation Feature Analyzing based Intrusion Detection System for Intelligent Connected Vehicles

“…In 2019, Pawelec et al [26] proposed a 3-layer LSTM neural network to predict the data payload for each CAN ID, which avoided reverse engineering proprietary encoding. Similarly, Qin et al [12] also implemented anomaly detection for CAN bus based on timing features by LSTM and re-considered two data formats of CAN frames.…”

Cybersecurity protection on in‐vehicle networks for distributed automotive cyber‐physical systems: State‐of‐the‐art and future challenges

“…Jichici et al 46 evaluate the possibilities for integrating the NN‐based IDS on automotive‐grade embedded platforms, and the experiment results show that this task is quite challenging due to large requirement of memory size and computational power. Pawelec et al 47 test the effectiveness of employing DNN to predict CAN message at the bit level, which would offer the IDS capability but avoiding reverse engineering proprietary encodings of CAN messages. Kuwahara et al 48 study the applicability of statistical anomaly detection methods to identify malicious CAN messages, where a pipeline technology is proposed to extract the timestamp and ID information in each messages quickly, and the efficiency of the proposed method is evaluated in real message datasets and in supervised and unsupervised cases.…”

CAN-D: A Modular Four-Step Pipeline for Comprehensively Decoding Controller Area Network Data

“…In parallel, CAN defensive security research is growing quickly; we found 15 surveys of the area since 2017, e.g., [23,24], with over 60 works on CAN intrusion detection between 2016-19. Yet these works are impeded by obfuscated CAN data, forced to either use side-channel methods that ignore message contents [25][26][27], use black-box methods ignorant of message meanings [28][29][30], or either arduously reverse engineer a few signals for a specific vehicle [31] or rely on an OEM for signal definitions [32], which keeps CAN security in the OEM's hands and develops per-make (not vehicle-agnostic) capabilities. A vehicle-agnostic CAN signal reverse engineering tool promises to remove these limitations and provide rich, online, time-series data for advancements in detection and other security technologies.…”