Anomaly detection of CAN bus messages through analysis of ID sequences

This paper proposes a novel intrusion detection algorithm that aims to identify malicious CAN messages injected by attackers in the CAN bus of modern vehicles. The proposed algorithm identifies anomalies in the sequence of messages that flow in the CAN bus and is characterized by small memory and computational footprints, that make it applicable to current ECUs. Its detection performance are demonstrated through experiments carried out on real CAN traffic gathered from an unmodified licensed vehicle.

[1]  Michele Colajanni,et al.  Enhancing interoperability and stateful analysis of cooperative network intrusion detection systems , 2007, ANCS '07.

[2]  VARUN CHANDOLA,et al.  Anomaly detection: A survey , 2009, CSUR.

[3]  Marko Wolf,et al.  Design, Implementation, and Evaluation of a Vehicular Hardware Security Module , 2011, ICISC.

[4]  Michele Colajanni,et al.  Framework and Models for Multistep Attack Detection , 2011 .

[5]  Jaein Kim,et al.  Fuzzing CAN Packets into Automobiles , 2015, 2015 IEEE 29th International Conference on Advanced Information Networking and Applications.

[6]  Michele Colajanni,et al.  A collaborative framework for intrusion detection in mobile networks , 2015, Inf. Sci..

[7]  Luca Fanucci,et al.  An implementation of the 802.1AE MAC Security Standard for in-car networks , 2015, 2015 IEEE 2nd World Forum on Internet of Things (WF-IoT).

[8]  Nathalie Japkowicz,et al.  Frequency-based anomaly detection for the automotive CAN bus , 2015, 2015 World Congress on Industrial Control Systems Security (WCICSS).

[9]  Je-Won Kang,et al.  A Novel Intrusion Detection Method Using Deep Neural Network for In-Vehicle Network Security , 2016, 2016 IEEE 83rd Vehicular Technology Conference (VTC Spring).

[10]  Michele Colajanni,et al.  Evaluation of anomaly detection for in-vehicle networks through information-theoretic algorithms , 2016, 2016 IEEE 2nd International Forum on Research and Technologies for Society and Industry Leveraging a better tomorrow (RTSI).