EASI: Edge-Based Sender Identification on Resource-Constrained Platforms for Automotive Networks

In vehicles, internal Electronic Control Units (ECUs) are increasingly prone to adversarial exploitation over wireless connections due to ongoing digitalization. Controlling an ECU allows an adversary to send messages to the internal vehicle bus and thereby to control various vehicle functions. Access to the Controller Area Network (CAN), the most widely used bus technology, is especially severe as it controls brakes and steering. However, state of the art receivers are not able to identify the sender of a frame. Retrofitting frame authenticity, e.g. through Message Authentication Codes (MACs), is only possible to a limited extent due to reduced bandwidth, low payload and limited computational resources. To address this problem, observation in analog differences of the CAN signal was proposed to determine the actual sender. Some of the prior approaches exhibit good identification and detection rates, however require high sampling rates and a high computing effort. With EASI we significantly reduce the required resources and at the same time show increased identification rates of 99.98% by having no false positives in a prototype structure and two series production vehicles. In comparison to the most lightweight approach so far, we have reduced the memory footprint and the computational requirements by a factor of 168 and 142, respectively. In addition, we show the feasibility of EASI and thus demonstrate for the first time that voltage-based sender identification is realizable using comprehensive signal characteristics on resource-constrained platforms. Due to the lightweight design, we achieved a classification in under 100μs with a training time of 2.61 seconds. We also showed the ability to adapt the system to incremental signal changes during operation. Since cost effectiveness is of utmost importance in the automotive industry due to high production volumes, the achieved improvements are significant and necessary to realize sender identification.

[1]  Frederick R. Forst,et al.  On robust estimation of the location parameter , 1980 .

[2]  Robert C. Bolles,et al.  Random sample consensus: a paradigm for model fitting with applications to image analysis and automated cartography , 1981, CACM.

[3]  Priya Narasimhan,et al.  Challenges In Deeply Networked System Survivability , 2005 .

[4]  André Weimerskirch,et al.  State of the Art: Embedding Security in Vehicles , 2007, EURASIP J. Embed. Syst..

[5]  Jana Dittmann,et al.  Adaptive Dynamic Reaction to Automotive IT Security Incidents Using Multimedia Car Environment , 2008, 2008 The Fourth International Conference on Information Assurance and Security.

[6]  D.K. Nilsson,et al.  An approach to specification-based attack detection for in-vehicle networks , 2008, 2008 IEEE Intelligent Vehicles Symposium.

[7]  Jana Dittmann,et al.  Security threats to automotive CAN networks - Practical examples and selected short-term countermeasures , 2008, Reliab. Eng. Syst. Saf..

[8]  Philip Koopman,et al.  Flexible multicast authentication for time-triggered embedded control network applications , 2009, 2009 IEEE/IFIP International Conference on Dependable Systems & Networks.

[9]  Felix C. Freiling,et al.  A structured approach to anomaly detection for in-vehicle networks , 2010, 2010 Sixth International Conference on Information Assurance and Security.

[10]  Marko Wolf,et al.  Design, Implementation, and Evaluation of a Vehicular Hardware Security Module , 2011, ICISC.

[11]  Matti Valovirta,et al.  Experimental Security Analysis of a Modern Automobile , 2011 .

[12]  Hovav Shacham,et al.  Comprehensive Experimental Analyses of Automotive Attack Surfaces , 2011, USENIX Security Symposium.

[13]  J. Doug Tygar,et al.  Adversarial machine learning , 2019, AISec '11.

[14]  Robert Bosch,et al.  CAN with Flexible Data-Rate , 2012 .

[15]  Y. Suzuki,et al.  Novel ringing suppression circuit to increase the number of connectable ECUs in a linear passive star CAN , 2012, International Symposium on Electromagnetic Compatibility - EMC EUROPE.

[16]  Alberto L. Sangiovanni-Vincentelli,et al.  Cyber-Security for the Controller Area Network (CAN) Communication Protocol , 2012, 2012 International Conference on Cyber Security.

[17]  Bogdan Groza,et al.  Efficient Protocols for Secure Broadcast in Controller Area Networks , 2013, IEEE Transactions on Industrial Informatics.

[18]  Yves Deswarte,et al.  Survey on security threats and protection mechanisms in embedded automotive networks , 2013, 2013 43rd Annual IEEE/IFIP Conference on Dependable Systems and Networks Workshop (DSN-W).

[19]  João Gama,et al.  A survey on concept drift adaptation , 2014, ACM Comput. Surv..

[20]  Bogdan Groza,et al.  Source Identification Using Signal Characteristics in Controller Area Networks , 2014, IEEE Signal Processing Letters.

[21]  Dan Larsson,et al.  Exploring the Generic Timer Module’s Feasibility for Truck Powertrain Control , 2015 .

[22]  Stefan Savage,et al.  Fast and Vulnerable: A Story of Telematic Failures , 2015, WOOT.

[23]  Sean Davis,et al.  Statistical Genomics. Methods and Protocols. , 2016, Anticancer research.

[24]  Eibe Frank,et al.  Introducing Machine Learning Concepts with WEKA , 2016, Statistical Genomics.

[25]  T. Dagan.  Parrot , a software-only anti-spoofing defense system for the CAN bus , 2016 .

[26]  Kang G. Shin,et al.  Fingerprinting Electronic Control Units for Vehicle Intrusion Detection , 2016, USENIX Security Symposium.

[27]  Kang G. Shin,et al.  Error Handling of In-vehicle Networks Makes Them Vulnerable , 2016, CCS.

[28]  Sparsh Mittal.  A Survey of Architectural Techniques for Managing Process Variation , 2016, ACM Comput. Surv..

[29]  Kang G. Shin,et al.  Viden: Attacker Identification on In-Vehicle Networks , 2017, CCS.

[30]  Hafiz Malik,et al.  Linking received packet to the transmitter through physical-fingerprinting of controller area network , 2017, 2017 IEEE Workshop on Information Forensics and Security (WIFS).

[31]  Martin Ring,et al.  Cybersecurity Evaluation of Automotive E/E Architectures , 2018 .

[32]  Dong Hoon Lee,et al.  Identifying ECUs Using Inimitable Characteristics of Signals in Controller Area Networks , 2016, IEEE Transactions on Vehicular Technology.

[33]  Christopher Huth,et al.  Scission: Signal Characteristic-Based Sender Identification and Intrusion Detection in Automotive Networks , 2018, CCS.

[34]  Radha Poovendran,et al.  Cloaking the Clock: Emulating Clock Skew in Controller Area Networks , 2017, 2018 ACM/IEEE 9th International Conference on Cyber-Physical Systems (ICCPS).

[35]  Siraj A. Shaikh,et al.  Towards Viable Intrusion Detection Methods For The Automotive Controller Area Network , 2018 .

[36]  Chang Liu,et al.  Manipulating Machine Learning: Poisoning Attacks and Countermeasures for Regression Learning , 2018, 2018 IEEE Symposium on Security and Privacy (SP).

[37]  Zhenfu Cao,et al.  Detecting Vehicle Anomaly in the Edge via Sensor Consistency and Frequency Characteristic , 2019, IEEE Transactions on Vehicular Technology.

[38]  Ming Li,et al.  SIMPLE: single-frame based physical layer identification for intrusion detection and prevention on in-vehicle networks , 2019, ACSAC.

[39]  Tomas Olovsson,et al.  CASAD: CAN-Aware Stealthy-Attack Detection for In-Vehicle Networks , 2019, ArXiv.

[40]  Zhiqiang Cai,et al.  - 1-0-days & Mitigations : Roadways to Exploit and Secure Connected BMW Cars , 2019 .

[41]  Mauro Conti,et al.  TACAN: transmitter authentication through covert channels in controller area networks , 2019, ICCPS.