Android Head Units vs. In-Vehicle ECUs: Performance Assessment for Deploying In-Vehicle Intrusion Detection Systems for the CAN Bus

Abstract

Following the numerous attacks that exploited vulnerabilities of Controller Area Networks (CAN), intrusion detection systems have become a topic of prime importance for in-vehicle buses. Newer in-vehicle communication layers, such as CAN-FD, despite the larger payloads which can easily integrate cryptographic elements, need similar attention. But detecting intrusions may call for demanding algorithms that are not computationally cheap while timely detection is necessary in order to process frames in realtime and take the appropriate actions. In this work we evaluate the performance of several binary classifiers on traditional in-vehicle Electronic Control Units (ECUs) and compare them to modern Android devices which have become widespread inside cars with the adoption of Android-capable infotainment systems. Needless to say, these modern devices benefit from higher computational and memory resources while cloud connectivity may alleviate computational costs even further. Contrasting between traditional controllers and Android devices has become necessary and so far there have been little efforts in this direction. To create a realistic testbed, we use collected in-vehicle CAN bus traffic from an SUV as well as more demanding logs from Advanced Driver-assistance Systems (ADAS) implemented on CAN-FD which we augment with adversarial activity.