Addressing the Lack of Comparability &amp; Testing in CAN Intrusion Detection Research: A Comprehensive Guide to CAN IDS Data &amp; Introduction of the ROAD Dataset

Verma, Miki E.; Iannacone, Michael D.; Bridges, Robert A.; Hollifield, Samuel C.; Moriano, Pablo; Kay, Bill; Combs, Frank L.

doi:10.48550/arxiv.2012.14600

Cited by 7 publications

(15 citation statements)

References 0 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Step 1. Data Preprocessing First, the training sample data were obtained from two data sources: the common HCRL intrusion detection archive [32], and the HCRL Car-Hacking dataset, the latter of which were used in several other CAN IDS case studies [39,40]. The HCRL dataset contains 30-40 min of CAN traffic, with approximately 4 million total messages.…”

Section: An Analysis Model For Intrusion Detection Of An In-vehicle N...mentioning

confidence: 99%

Using Deep Learning Networks to Identify Cyber Attacks on Intrusion Detection for In-Vehicle Networks

et al. 2022

View full text Add to dashboard Cite

With rapid advancements in in-vehicle network (IVN) technology, the demand for multiple advanced functions and networking in electric vehicles (EVs) has recently increased. To enable various intelligent functions, the electrical system of existing vehicles incorporates a controller area network (CAN) bus system that enables communication among electrical control units (ECUs). In practice, traditional network-based intrusion detection systems (NIDSs) cannot easily identify threats to the CAN bus system. Therefore, it is necessary to develop a new type of NIDS—namely, on-the-move Intrusion Detection System (OMIDS)—to categorise these threats. Accordingly, this paper proposes an intrusion detection model for IVNs, based on the VGG16 classifier deep learning model, to learn attack behaviour characteristics and classify threats. The experimental dataset was provided by the Hacking and Countermeasure Research Lab (HCRL) to validate classification performance for denial of service (DoS), fuzzy attacks, spoofing gear, and RPM in vehicle communications. The proposed classifier’s performance was compared with that of the XBoost ensemble learning scheme to identify threats from in-vehicle networks. In particular, the test cases can detect anomalies in terms of accuracy, precision, recall, and F1-score to ensure detection accuracy and identify false alarm threats. The experimental results show that the classification accuracy of the dataset for HCRL Car-Hacking by the VGG16 and XBoost classifiers (n = 50) reached 97.8241% and 99.9995% for the 5-subcategory classification results on the testing data, respectively.

show abstract

Section: An Analysis Model For Intrusion Detection Of An In-vehicle N...mentioning

confidence: 99%

Using Deep Learning Networks to Identify Cyber Attacks on Intrusion Detection for In-Vehicle Networks

et al. 2022

View full text Add to dashboard Cite

show abstract

“…We used the ROAD dataset [4] to test our proposed forensic framework. The ROAD dataset is an open set of CAN data collected from a real vehicle with fabrication attacks and a few advanced attacks (e.g., masquerade attacks).…”

Section: Datasetmentioning

confidence: 99%

“…CAN attacks are commonly classified using a three-tiered taxonomy that includes fabrication, suspension, and masquerade attacks [3], [4]. Fabrication attacks inject extra frames, whereas suspension attacks remove benign frames; consequently, both categories usually disturb regular frame timing on the bus and can be accurately detected using time-based methods [5], [6], [7].…”

Section: Introductionmentioning

confidence: 99%

“…Masquerade attacks can still be detected because they alter the regular relationships of a vehicle's subsystems. Using an example attack from the ROAD [4] dataset, an adversary that gains control of the ECU(s) that communicate the wheel speed signals (four nearly identical signals) can modify the frames to break the near perfect correlation, which will stop the vehicle (regardless of the driver's actions). By understating the regular relationships of the vehicle's CAN signals, this condition can be flagged as anomalous, even if the modified signals are not abnormal when considered individually.…”

Section: Introductionmentioning

confidence: 99%

“…We report our results and offer possible explanations. • We evaluate the proposed framework on masquerade attacks from the ROAD dataset [4]. Evaluation results show very high effectiveness of detecting attacks of different levels of sophistication.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Detecting CAN Masquerade Attacks with Signal Clustering Similarity

Moriano¹,

Bridges²,

Iannacone³

2022

Proceedings Fourth International Workshop on Automotive and Autonomous Vehicle Security

View full text Add to dashboard Cite

Vehicular Controller Area Networks (CANs) are susceptible to cyber attacks of different levels of sophistication. Fabrication attacks are the easiest to administer-an adversary simply sends (extra) frames on a CAN-but also the easiest to detect because they disrupt frame frequency. To overcome timebased detection methods, adversaries must administer masquerade attacks by sending frames in lieu of (and therefore at the expected time of) benign frames but with malicious payloads. Research efforts have proven that CAN attacks, and masquerade attacks in particular, can affect vehicle functionality. Examples include causing unintended acceleration, deactivation of vehicle's brakes, as well as steering the vehicle. We hypothesize that masquerade attacks modify the nuanced correlations of CAN signal time series and how they cluster together. Therefore, changes in cluster assignments should indicate anomalous behavior. We confirm this hypothesis by leveraging our previously developed capability for reverse engineering CAN signals (i.e., CAN-D [Controller Area Network Decoder]) and focus on advancing the state of the art for detecting masquerade attacks by analyzing time series extracted from raw CAN frames. Specifically, we demonstrate that masquerade attacks can be detected by computing time series clustering similarity using hierarchical clustering on the vehicle's CAN signals (time series) and comparing the clustering similarity across CAN captures with and without attacks. We test our approach in a previously collected CAN dataset with masquerade attacks (i.e., the ROAD dataset) and develop a forensic tool as a proof of concept to demonstrate the potential of the proposed approach for detecting CAN masquerade attacks.This manuscript has been co-authored by UT-Battelle, LLC, under contract DE-AC05-00OR22725 with the US Department of Energy (DOE). The US government retains and the publisher, by accepting the article for publication, acknowledges that the US government retains a nonexclusive, paid-up, irrevocable, worldwide license to publish or reproduce the published form of this manuscript, or allow others to do so, for US government purposes. DOE will provide public access to these results of federally sponsored research in accordance with the DOE Public Access Plan (http://energy.gov/downloads/doe-public-access-plan).

show abstract

CANTool An In-Vehicle Network Data Analyzer

Islam

Yim

2022

2022 International Conference on Information Technology Systems and Innovation (ICITSI)

View full text Add to dashboard Cite

Addressing the Lack of Comparability & Testing in CAN Intrusion Detection Research: A Comprehensive Guide to CAN IDS Data & Introduction of the ROAD Dataset

Cited by 7 publications

References 0 publications

Using Deep Learning Networks to Identify Cyber Attacks on Intrusion Detection for In-Vehicle Networks

Using Deep Learning Networks to Identify Cyber Attacks on Intrusion Detection for In-Vehicle Networks

Detecting CAN Masquerade Attacks with Signal Clustering Similarity

CANTool An In-Vehicle Network Data Analyzer

Contact Info

Product

Resources

About