CopyCAN

Abstract

In the last years, the automotive industry has incorporated more and more electronic components in vehicles, leading to complex on-board networks of Electronic Control Units (ECUs) that communicate with each other to control all vehicle functions, making it safer and easier to drive. This communication often relies on Controller Area Network (CAN), a bus communication protocol that defines a standard for real-time reliable and efficient transmission. However, CAN does not provide any security measure against cyber attacks. In particular, it lacks of message authentication, leading to the possibility of transmitting spoofed CAN messages for malicious purposes. Nowadays, Intrusion Detection Systems (IDSs) detect such attacks by identifying inconsistencies in the stream of information allegedly transmitted by a single ECU, hence assuming the existence of a second malicious node generating these messages. However, attackers can bypass this defense technique by disconnecting from the network the ECU of which they want to spoof the messages, therefore removing the authentic source of information. To contrast this attack, we present CopyCAN, an Intrusion Detection System (IDS) that detects whether a node has been disconnected by monitoring the traffic and deriving the error counters of ECUs on CAN. Through this process, it flags subsequent spoofed messages as attacks and reacts accordingly even if there is no inconsistency in the stream of information. Our system, unlike many previous attempts to address security issues in CAN, does not require any modification to the protocol or to already installed ECUs. Instead, it only requires the installation of a monitoring unit to the existing network, making it easily deployable in current systems and compliant with required CAN standards.

Evaluating the Robustness of Automotive Intrusion Detection Systems Against Evasion Attacks

“…Therefore, an attacker that takes control of an ECU that has access to a CAN bus can ideally send any ID and payload. In worst-case scenarios, the attacker is also capable of silencing the owner of the packet to avoid conflicts, as presented in [25]. In brief, an attacker may affect the payload and flow of packets on the bus.…”

CANova: A hybrid intrusion detection framework based on automatic signal classification for CAN

“…Consequently, they can detect a wide range of attacks but usually have high computational requirements and are not as effective against frequency-based attacks. Considering attacks to CAN, flow-based approaches cannot be used as a standalone solution since an adversary in a compromised system can send malicious packets without changing their frequency by forcing the transmitting ECU in the bus-off state before communicating [4,5]. On the other hand, payload-based approaches may not be suited for real-time detection of the entire traffic of the network.…”