Clock-Based Sender Identification and Attack Detection for Automotive CAN Network

Abstract

Building the security mechanism for Controller Area Network (CAN) to defend against attack has drawn substantial attention recently. Fingerprinting ECUs to provide the ability of authentication based on the physical characteristics can protect the CAN network effectively. The clock skew which is unique and stable can be exploited to pinpoint the attacker and detect intrusion. However, a common downside of existing clock-skew-based approaches is that the estimation process can be affected by the message scheduling or arbitration. In our work, a novel intrusion detection system (IDS) that exploits the inherent difference in the clock of devices for automotive CAN network is designed. The estimation process of clock skew in our approach relies only on the time measurement of a single CAN frame. Thus, the disturbance from the data-link layer can be avoided. Since the performance of our IDS depends heavily on the accuracy of estimated clock skew, our approach is evaluated on CAN networks with different settings to simulate cases in which the sampling rate is sufficient or not. The feasibility as well as the limitation of our approach are presented in our work. The evaluation shows that our IDS can identify the sender and detect attacks with an average identification rate of more than 99.7% when the sampling rate is sufficient. Besides, the performance degradation as low sampling accuracy is shown and feasible measures for improvement are also discussed.

Intrusion detection and defence for CAN bus through frequency anomaly analysis and arbitration mechanism

“… c The method is described in [12], where N represents the number of data frames required for fingerprint extraction;…”

“…We have configured the three ECU message simulation modules to send messages with different intervals. Specifically, module #1 is set to transmit messages with ID 38A at intervals of 10 ms, module #2 is set to transmit messages with ID 0BA at intervals of 25 ms, and module #3 is set to transmit messages with ID 2B6 at intervals of 500 ms. Then The method is described in [11]; c The method is described in [12], where N represents the number of data frames required for fingerprint extraction; d The method is described in [6].…”

“…The existing research on security protection for vehicular CAN bus mainly includes security defence schemes based on cryptographic primitives [7][8][9] and intrusion detection methods [6,[10][11][12][13][14]. The former schemes are limited by the bandwidth of CAN bus, strong real-time requirements, and node computing performance, and need to compromise on security by transmitting authentication tags through lightweight authentication frameworks or covert channels.…”

CAN Bus Intrusion Detection Based on Auxiliary Classifier GAN and Out-of-distribution Detection

“…The detection approaches can be broadly categorized into either rule-based, where humans design detection rules manually, or ML-based, where an ML model is trained from data. Rule-based approaches include: methods based on physical fingerprints, e.g., clock [59] or voltage measurements [14]; methods based on message timing [39,44] or frequency [48]; methods based on message ID entropy [51] or Hamming distance [46], and many others. Due to the increasing complexity and diversity of in-vehicle network workloads, rule-based methods are generally viewed as not as accurate or flexible/adaptable as ML-based methods [56].…”

Coexisting Parallelogram Method to Handle Jump Point on Hough Transform-based Clock Skew Measurement

“…When the skews are similar or they are both still at a certain threshold, the device is called a valid device. Other area exploring clock skew are distributed anonymity architecture [20], [27], non-cryptography security [28], [35] and wireless sensor network [32], [33]. All areas used clock skew depends on the accurate value of the measured clock skew.…”