Modern vehicles rely on hundreds of on-board electronic control units (ECUs) communicating over in-vehicle networks. As external interfaces to the car control networks (such as the on-board diagnostic (OBD) port, auxiliary media ports, etc.) become common, and vehicle-to-vehicle / vehicle-to-infrastructure technology is in the near future, the a ack surface for vehicles grows, exposing control networks to potentially life-critical a acks. is paper addresses the need for securing the controller area network (CAN) bus by detecting anomalous tra c pa erns via unusual refresh rates of certain commands. While previous works have identi ed signal frequency as an important feature for CAN bus intrusion detection, this paper provides the rst such algorithm with experiments using three a acks in ve (total) scenarios. Our data-driven anomaly detection algorithm requires only ve seconds of training time (on normal data) and achieves true positive / false discovery rates of 0.9998/0.00298, respectively (micro-averaged across the ve experimental tests).

No abstract

No abstract

No abstract

No abstract