Towards a CAN IDS based on a neural-network data field predictor

by   Krzysztof Pawelec, et al.

Modern vehicles contain a few controller area networks (CANs), which allow scores of on-board electronic control units (ECUs) to communicate messages critical to vehicle functions and driver safety. CAN provide a lightweight and reliable broadcast protocol but is bereft of security features. As evidenced by many recent research works, CAN exploits are possible both remotely and with direct access, fueling a growing CAN intrusion detection system (IDS) body of research. A challenge for pioneering vehicle-agnostic IDSs is that passenger vehicles' CAN message encodings are proprietary, defined and held secret by original equipment manufacturers (OEMs). Targeting detection of next-generation attacks, in which messages are sent from the expected ECU at the expected time but with malicious content, researchers are now seeking to leverage "CAN data models", which predict future CAN message contents and use prediction error to identify anomalous, hopefully malicious CAN messages. Yet, current works model CAN signals post-translation, i.e., after applying OEM-donated or reverse-engineered translations from raw data. In this work, we present initial IDS results testing deep neural networks used to predict CAN data at the bit level, thereby providing IDS capabilities but avoiding reverse engineering proprietary encodings. Our results suggest the method is promising for continuous signals in CAN data, but struggles for discrete, e.g., binary, signals.


page 3

page 4


X-CANIDS: Signal-Aware Explainable Intrusion Detection System for Controller Area Network-Based In-Vehicle Network

Controller Area Network (CAN) is an essential networking protocol that c...

CAN-D: A Modular Four-Step Pipeline for Comprehensively Decoding Controller Area Network Data

CANs are a broadcast protocol for real-time communication of critical ve...

Exploiting the Shape of CAN Data for In-Vehicle Intrusion Detection

Modern vehicles rely on scores of electronic control units (ECUs) broadc...

ACTT: Automotive CAN Tokenization and Translation

Modern vehicles contain scores of Electrical Control Units (ECUs) that b...

Detection of Message Injection Attacks onto the CAN Bus using Similarity of Successive Messages-Sequence Graphs

The smart features of modern cars are enabled by a number of Electronic ...

Automated Fuzzing of Automotive Control Units

Modern vehicles are governed by a network of Electronic Control Units (E...

Please sign up or login with your details

Forgot password? Click here to reset