Modern vehicles are equipped with Electronic Control Units (ECUs) and external communication devices. The Controller Area Network (CAN), a widely used communication protocol for ECUs, does not have a security mechanism to detect improper packets; if attackers exploit the vulnerability of an ECU and manage to inject a malicious message, they are able to control other ECUs to cause improper operation of the vehicle. With the increasing popularity of connected cars, it has become an urgent matter to protect in-vehicle networks against security threats. In this paper, we study the applicability of statistical anomaly detection methods for identifying malicious CAN messages in invehicle networks. We focus on intrusion attacks of malicious messages. Because the occurrence of an intrusion attack certainly influences the message traffic, we focus on the number of messages observed in a fixed time window to detect intrusion attacks. We formalize features to represent a message sequence that incorporates the number of messages associated with each receiver ID. We collected CAN message data from an actual vehicle and conducted a quantitative analysis of the methods and the features in practical situations. The results of our experiments demonstrated our proposed methods provide fast and accurate detection in various cases.

No abstract

No abstract

No abstract

Twenty-four Japanese undergraduate pairs (12 male and 12 female pairs) participated as witnesses to a simulated criminal event. Although the witness pairs watched the same video together, through wireless headphones they experienced two different auditory versions with four differing items without being aware of the discrepancies. After the presentation, the witnesses were led to discuss six items, including two critical ones they had heard differently and another four they had heard in common. Witness memory performance was assessed individually with multiple-choice questionnaires in three sessions: before the discussion, after the discussion, and 1 week later. The results showed that participants tended to conform to their co-witness more often on the discussed items than on the not-discussed items. Source monitoring analyses on the four critical items revealed that even those participants who conformed were mostly cognizant of the source of their information just after the discussion, but they were prone to source-monitoring errors a week later.