CAN-D: A Modular Four-Step Pipeline for Comprehensively Decoding Controller Area Network Data

Verma, Miki E.; Bridges, Robert A.; Sosnowski, Jordan J.; Hollifield, Samuel C.; Iannacone, Michael D.

doi:10.1109/tvt.2021.3092354

Cited by 22 publications

(24 citation statements)

References 21 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We assume that the time series signal translation (or at least a high-fidelity translation) is readily available for use. This seems feasible with current and upcoming work in reverse engineering CAN bus signals, such as CAN-D [14].…”

Section: Discussionmentioning

confidence: 99%

“…First, there is a semantic gap with respect to the signals encoded in the payload. This means that a single CAN frame's payload usually contains several signals encoded in different formats, including byte ordering, signedness, label and units, and scale and offset [14]. Second, detecting subtle masquerade attacks requires analyzing the payload content because the correlation between certain signals may change when the frame content is modified during an attack; hence, analyzing translated signals is a promising avenue.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Detecting CAN Masquerade Attacks with Signal Clustering Similarity

Moriano¹,

Bridges²,

Iannacone³

2022

Proceedings Fourth International Workshop on Automotive and Autonomous Vehicle Security

View full text Add to dashboard Cite

Vehicular Controller Area Networks (CANs) are susceptible to cyber attacks of different levels of sophistication. Fabrication attacks are the easiest to administer-an adversary simply sends (extra) frames on a CAN-but also the easiest to detect because they disrupt frame frequency. To overcome timebased detection methods, adversaries must administer masquerade attacks by sending frames in lieu of (and therefore at the expected time of) benign frames but with malicious payloads. Research efforts have proven that CAN attacks, and masquerade attacks in particular, can affect vehicle functionality. Examples include causing unintended acceleration, deactivation of vehicle's brakes, as well as steering the vehicle. We hypothesize that masquerade attacks modify the nuanced correlations of CAN signal time series and how they cluster together. Therefore, changes in cluster assignments should indicate anomalous behavior. We confirm this hypothesis by leveraging our previously developed capability for reverse engineering CAN signals (i.e., CAN-D [Controller Area Network Decoder]) and focus on advancing the state of the art for detecting masquerade attacks by analyzing time series extracted from raw CAN frames. Specifically, we demonstrate that masquerade attacks can be detected by computing time series clustering similarity using hierarchical clustering on the vehicle's CAN signals (time series) and comparing the clustering similarity across CAN captures with and without attacks. We test our approach in a previously collected CAN dataset with masquerade attacks (i.e., the ROAD dataset) and develop a forensic tool as a proof of concept to demonstrate the potential of the proposed approach for detecting CAN masquerade attacks.This manuscript has been co-authored by UT-Battelle, LLC, under contract DE-AC05-00OR22725 with the US Department of Energy (DOE). The US government retains and the publisher, by accepting the article for publication, acknowledges that the US government retains a nonexclusive, paid-up, irrevocable, worldwide license to publish or reproduce the published form of this manuscript, or allow others to do so, for US government purposes. DOE will provide public access to these results of federally sponsored research in accordance with the DOE Public Access Plan (http://energy.gov/downloads/doe-public-access-plan).

show abstract

Section: Discussionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Detecting CAN Masquerade Attacks with Signal Clustering Similarity

Moriano¹,

Bridges²,

Iannacone³

2022

Proceedings Fourth International Workshop on Automotive and Autonomous Vehicle Security

View full text Add to dashboard Cite

show abstract

“…The highspeed TTCAN protocol comprises the main controller, instrument display, fault diagnosis, Antilock Brake System (ABS) control, and engine control. The low-speed TTCAN protocol includes locking control, electric door control, mechanical control, and lighting control [23].…”

Section: Research On Theoretical Basis Andmentioning

confidence: 99%

Analysis of Transportation Network Scheduling of Maritime Silk Road and International Digital Trade Potential Based on Improved Genetic Algorithm under Digital Trade Barriers

Zhang

Pan

2022

Wireless Communications and Mobile Computing

View full text Add to dashboard Cite

The purpose is to improve the ship scheduling capability of the Maritime Silk Road transportation network and advance the international digital trade capabilities along China’s Maritime Silk Road. The optimization process of ship network scheduling based on a simulated annealing- (SA-) improved genetic algorithm (GA) is studied. Then, according to the time-varying stochastic frontier gravity model, the potential of international digital trade between China and the countries on the western route of the Maritime Silk Road is analyzed. The model is simulated and verified. The results reveal that the improved GA has obvious advantages over other algorithms in the message delivery rate of the high-speed and low-speed TT Controller Area Network (TTCAN) protocol for ship control. Regardless of the external environment and the number of message nodes, the message delivery rate is above 95%, showing a high delivery rate and the best network scheduling effect. The total volume and proportion of trade between China and the countries along the western route of the Maritime Silk Road can represent a good growth trend over time, and the proportion of digital trade exports has increased from 9.75% in 2009 to 45.12% in 2020. China has great potential for the development of the countries along the Silk Road as a whole. The main contribution of the research is to construct the ship network scheduling optimization process of the GA improved by the SA and use the time-varying stochastic frontier gravity model to study the digital trade potential between China and the countries along the Maritime Silk Road. The data information management system for network dispatching of marine ships has been improved, and the optimal dispatching efficiency has been enhanced.

show abstract

“…However, it is difficult for them to understand the specific meaning of m owing to the lack of information regarding the exact representation of the given a and p. Meanwhile, researchers who wish to build after-market autonomous driving kits or use in-vehicle signals for specific purposes, such as building a payload-based IDS for CAN buses [15], are motivated to reverse engineer CAN message payloads. Because manual reverse engineering requires substantial effort, several automated methods have been proposed for this purpose [16], [17], [18], [19], [20], [21], [22], and increasingly sophisticated results have been achieved in recent years. However, these methods remain insufficient for deserializing hundreds of signals precisely.…”

Section: B Can Framementioning

confidence: 99%

“…One study [22] attempted payload slicing in a heuristic manner to detect intrusions more effectively. Several studies have focused on the automatic reverse engineering of payloads [16], [17], [18], [19], [20], [21], [22]. OBD-II queries.…”

Section: Signal-aware Idssmentioning

confidence: 99%

Autocorrelation-based Intrusion Detection System for Controller Area Network (CAN)

Jeong¹,

Choi²,

Choi³

2021

J.ICROS

View full text Add to dashboard Cite

Controller Area Network (CAN) is an essential networking protocol that connects multiple electronic control units (ECUs) in a vehicle. However, CAN-based in-vehicle networks (IVNs) face security risks owing to the CAN mechanisms. An adversary can sabotage a vehicle by leveraging the security risks if they can access the CAN bus. Thus, recent actions and cybersecurity regulations (e.g., UNR 155) require carmakers to implement intrusion detection systems (IDSs) in their vehicles. An IDS should detect cyberattacks and provide a forensic capability to analyze attacks. Although many IDSs have been proposed, considerations regarding their feasibility and explainability remain lacking. This study proposes X-CANIDS, which is a novel IDS for CAN-based IVNs. X-CANIDS dissects the payloads in CAN messages into human-understandable signals using a CAN database. The signals improve the intrusion detection performance compared with the use of bit representations of raw payloads. These signals also enable an understanding of which signal or ECU is under attack. X-CANIDS can detect zero-day attacks because it does not require any labeled dataset in the training phase. We confirmed the feasibility of the proposed method through a benchmark test on an automotivegrade embedded device with a GPU. The results of this work will be valuable to carmakers and researchers considering the installation of in-vehicle IDSs for their vehicles.

show abstract

CAN-D: A Modular Four-Step Pipeline for Comprehensively Decoding Controller Area Network Data

Cited by 22 publications

References 21 publications

Detecting CAN Masquerade Attacks with Signal Clustering Similarity

Detecting CAN Masquerade Attacks with Signal Clustering Similarity

Analysis of Transportation Network Scheduling of Maritime Silk Road and International Digital Trade Potential Based on Improved Genetic Algorithm under Digital Trade Barriers

Autocorrelation-based Intrusion Detection System for Controller Area Network (CAN)

Contact Info

Product

Resources

About