CANova: A hybrid intrusion detection framework based on automatic signal classification for CAN

Nichelini, Alessandro; Pozzoli, Carlo Alberto; Longari, Stefano; Carminati, Michele; Zanero, Stefano

doi:10.1016/j.cose.2023.103166

Cited by 15 publications

(2 citation statements)

References 35 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Frequency/Timing-Based: Regards the timing or sequencing of arbitration IDs [17,[19][20][21][22][23] Payload-Based: Considers the data frame (message contents) as a string of bits, without explicitly recovering the signals these bits represent [16,[24][25][26][27][28][29][30] Signal-Based: Requires first decoding raw data field bits into constituent signals, and uses time series' of signal values as inputs [5,17,[31][32][33][34][35][36][37] Physical Side-Channel: Uses physical layer attributes (e.g., voltage) [15,[38][39][40] Other: Includes works that do not fall into the above categories (e.g., using rules to guarantee specific characteristics of the CAN messages are followed [41,42]).…”

Section: The Growth and State Of Can Ids Researchmentioning

confidence: 99%

A comprehensive guide to CAN IDS data and introduction of the ROAD dataset

Verma,

Bridges,

Iannacone

et al. 2024

PLoS ONE

View full text Add to dashboard Cite

Although ubiquitous in modern vehicles, Controller Area Networks (CANs) lack basic security properties and are easily exploitable. A rapidly growing field of CAN security research has emerged that seeks to detect intrusions or anomalies on CANs. Producing vehicular CAN data with a variety of intrusions is a difficult task for most researchers as it requires expensive assets and deep expertise. To illuminate this task, we introduce the first comprehensive guide to the existing open CAN intrusion detection system (IDS) datasets. We categorize attacks on CANs including fabrication (adding frames, e.g., flooding or targeting and ID), suspension (removing an ID’s frames), and masquerade attacks (spoofed frames sent in lieu of suspended ones). We provide a quality analysis of each dataset; an enumeration of each datasets’ attacks, benefits, and drawbacks; categorization as real vs. simulated CAN data and real vs. simulated attacks; whether the data is raw CAN data or signal-translated; number of vehicles/CANs; quantity in terms of time; and finally a suggested use case of each dataset. State-of-the-art public CAN IDS datasets are limited to real fabrication (simple message injection) attacks and simulated attacks often in synthetic data, lacking fidelity. In general, the physical effects of attacks on the vehicle are not verified in the available datasets. Only one dataset provides signal-translated data but is missing a corresponding “raw” binary version. This issue pigeon-holes CAN IDS research into testing on limited and often inappropriate data (usually with attacks that are too easily detectable to truly test the method). The scarcity of appropriate data has stymied comparability and reproducibility of results for researchers. As our primary contribution, we present the Real ORNL Automotive Dynamometer (ROAD) CAN IDS dataset, consisting of over 3.5 hours of one vehicle’s CAN data. ROAD contains ambient data recorded during a diverse set of activities, and attacks of increasing stealth with multiple variants and instances of real (i.e. non-simulated) fuzzing, fabrication, unique advanced attacks, and simulated masquerade attacks. To facilitate a benchmark for CAN IDS methods that require signal-translated inputs, we also provide the signal time series format for many of the CAN captures. Our contributions aim to facilitate appropriate benchmarking and needed comparability in the CAN IDS research field.

show abstract

Section: The Growth and State Of Can Ids Researchmentioning

confidence: 99%

A comprehensive guide to CAN IDS data and introduction of the ROAD dataset

Verma,

Bridges,

Iannacone

et al. 2024

PLoS ONE

View full text Add to dashboard Cite

show abstract

“…More often, to automatize the recognition of patterns and thresholds, solutions are based on machine learning algorithms: LSTM autoencoders [26], deep neural networks [19], RNN [27] have all been proposed as anomaly detectors for CAN. Finally, researchers have proposed various multi-stage IDSs that propose ensembles of flow-and payloadbased systems [33].…”

Section: Background and Related Workmentioning

confidence: 99%

Evaluating the Robustness of Automotive Intrusion Detection Systems Against Evasion Attacks

Longari

Noseda

Carminati

et al. 2023

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

This paper discusses the robustness of machine learning-based intrusion detection systems (IDSs) used in the Controller Area Networks context against adversarial samples, inputs crafted to deceive the system. We design a novel methodology to deploy evasion attacks and address the domain-specific challenges (i.e., the time-dependent nature of automotive networks) discussing the problem of performing online attacks. We evaluate the robustness of state-of-the-art IDSs on a real-world dataset by performing evasion attacks. We show that, depending on the targeted IDS and the degree of the attacker's knowledge, our approach achieves significantly different evasion rates.

show abstract

A Graph-Based Strategy for Intrusion Detection in Connected Vehicles

Sreelekshmi,

Aji

2024

Lecture Notes in Networks and Systems

View full text Add to dashboard Cite

CANova: A hybrid intrusion detection framework based on automatic signal classification for CAN

Cited by 15 publications

References 35 publications

A comprehensive guide to CAN IDS data and introduction of the ROAD dataset

A comprehensive guide to CAN IDS data and introduction of the ROAD dataset

Evaluating the Robustness of Automotive Intrusion Detection Systems Against Evasion Attacks

A Graph-Based Strategy for Intrusion Detection in Connected Vehicles

Contact Info

Product

Resources

About