CANShield: Deep-Learning-Based Intrusion Detection Framework for Controller Area Networks at the Signal Level

Abstract

Modern vehicles rely on a fleet of electronic control units (ECUs) connected through controller area network (CAN) buses for critical vehicular control. With the expansion of advanced connectivity features in automobiles and the elevated risks of internal system exposure, the CAN bus is increasingly prone to intrusions and injection attacks. As ordinary injection attacks disrupt the typical timing properties of the CAN data stream, rule-based intrusion detection systems (IDS) can easily detect them. However, advanced attackers can inject false data to the signal/semantic level, while looking innocuous by the pattern/frequency of the CAN messages. The rule-based IDS, as well as the anomaly-based IDS, are built merely on the sequence of CAN messages IDs or just the binary payload data and are less effective in detecting such attacks. Therefore, to detect such intelligent attacks, we propose CANShield, a deep learningbased signal-level intrusion detection framework for the CAN bus. CANShield consists of three modules: a data preprocessing module that handles the high-dimensional CAN data stream at the signal level and parses them into time series suitable for a deep learning model; a data analyzer module consisting of multiple deep autoencoder (AE) networks, each analyzing the time-series data from a different temporal scale and granularity, and finally an attack detection module that uses an ensemble method to make the final decision. Evaluation results on two highfidelity signal-based CAN attack datasets show the high accuracy and responsiveness of CANShield in detecting advanced intrusion attacks.

A comprehensive guide to CAN IDS data and introduction of the ROAD dataset

“…Frequency/Timing-Based: Regards the timing or sequencing of arbitration IDs [17,[19][20][21][22][23] Payload-Based: Considers the data frame (message contents) as a string of bits, without explicitly recovering the signals these bits represent [16,[24][25][26][27][28][29][30] Signal-Based: Requires first decoding raw data field bits into constituent signals, and uses time series' of signal values as inputs [5,17,[31][32][33][34][35][36][37] Physical Side-Channel: Uses physical layer attributes (e.g., voltage) [15,[38][39][40] Other: Includes works that do not fall into the above categories (e.g., using rules to guarantee specific characteristics of the CAN messages are followed [41,42]).…”

“…Another key aspect of introducing the research community to the ROAD dataset is that it provides a quality platform to test novel IDS architectures. In [37,[71][72][73][74][75][76][77][78], researchers use the ROAD dataset for evaluation purposes from a novel IDS method. Jin et al combine oversampling, outlier detection, and metric learning for intrusion detection and evaluate their model on ROAD (and other datasets) [71].…”

“…Signal-Based : Requires first decoding raw data field bits into constituent signals, and uses time series’ of signal values as inputs [ 5 , 17 , 31 – 37 ]…”

“…Cheng et al propose the model as a means of anomaly detection capable of reducing data complexity for constructing spatial-temporal features and exposing attacks. Shahriar et al compare evaluation of a model called CANShield between ROAD and SynCAN datasets [ 37 ]. Researchers show anomaly scores and ROC curves for the attacks occurring with the ROAD dataset.…”