Intrusion detection system based on the analysis of time intervals of CAN messages for in-vehicle network

Song, Hyun Min; Kim, Ha Rang; Kim, Huy Kang

doi:10.1109/icoin.2016.7427089

Cited by 362 publications

(192 citation statements)

References 4 publications

Supporting

Mentioning

159

Contrasting

Unclassified

Order By: Relevance

“…Recently, there has been some research for IDS to detect attacks targeted on the vehicles. For example, Song et al proposed a detection model based on time interval analysis of CAN data [1], and Lee et al presented a method to detect intrusion by monitoring the time interval of the request and response of CAN data [2].…”

Section: Introductionmentioning

confidence: 99%

GIDS: GAN based Intrusion Detection System for In-Vehicle Network

Seo

Song

Kim

2018

2018 16th Annual Conference on Privacy, Security and Trust (PST)

Self Cite

355

262

View full text Add to dashboard Cite

A Controller Area Network (CAN) bus in the vehicles is an efficient standard bus enabling communication between all Electronic Control Units (ECU). However, CAN bus is not enough to protect itself because of lack of security features. To detect suspicious network connections effectively, the intrusion detection system (IDS) is strongly required. Unlike the traditional IDS for Internet, there are small number of known attack signatures for vehicle networks. Also, IDS for vehicle requires high accuracy because any false-positive error can seriously affect the safety of the driver. To solve this problem, we propose a novel IDS model for in-vehicle networks, GIDS (GAN based Intrusion Detection System) using deep-learning model, Generative Adversarial Nets. GIDS can learn to detect unknown attacks using only normal data. As experiment result, GIDS shows high detection accuracy for four unknown attacks.

show abstract

Section: Introductionmentioning

confidence: 99%

GIDS: GAN based Intrusion Detection System for In-Vehicle Network

Seo

Song

Kim

2018

2018 16th Annual Conference on Privacy, Security and Trust (PST)

Self Cite

355

262

View full text Add to dashboard Cite

show abstract

“…As a result, injecting or dropping CAN frames should evidently increase the entropy of in-vehicle network and in turn expose an intrusion. Song et al [18] worked in a similar fashion but used the time interval between CAN frames to inspect suspicious frames. Taylor et al [14] emphasized on the data transmitted on CAN bus and proposed a recurrent neural network (RNN) based anomaly detector.…”

Section: Background and Related Workmentioning

confidence: 99%

Road Context-Aware Intrusion Detection System for Autonomous Cars

Jiang

Wang

Chattopadhyay

et al. 2020

Information and Communications Security

View full text Add to dashboard Cite

Security is of primary importance to vehicles. The viability of performing remote intrusions onto the in-vehicle network has been manifested. In regard to unmanned autonomous cars, limited work has been done to detect intrusions for them while existing intrusion detection systems (IDSs) embrace limitations against strong adversaries. In this paper, we consider the very nature of autonomous car and leverage the road context to build a novel IDS, named Road context-aware IDS (RAIDS). When a computer-controlled car is driving through continuous roads, road contexts and genuine frames transmitted on the car's in-vehicle network should resemble a regular and intelligible pattern. RAIDS hence employs a lightweight machine learning model to extract road contexts from sensory information (e.g., camera images and distance sensor values) that are used to generate control signals for maneuvering the car. With such ongoing road context, RAIDS validates corresponding frames observed on the in-vehicle network. Anomalous frames that substantially deviate from road context will be discerned as intrusions. We have implemented a prototype of RAIDS with neural networks, and conducted experiments on a Raspberry Pi with extensive datasets and meaningful intrusion cases. Evaluations show that RAIDS significantly outperforms state-of-the-art IDS without using road context by up to 99.9% accuracy and short response time.

show abstract

“…Hence, there is an urgent need for securing CAN buses. Security solutions for CAN can be broadly classified into schemes that add cryptographic measures to the CAN bus [8]- [10], [18] and anomaly-based IDSs that 1) analyze the traffic on the CAN bus including message contents [19]- [21], timing/frequency [15], [22]- [25], entropy [26], and survival rates [27], 2) exploit the physical characteristics of ECUs extracted from in-vehicle sensing data [28]- [30] or measurements [11], [13], [14], [31], [32], and 3) exploit the characteristics of the CAN protocol, such as the remote frame [33]. Compared to the CAN traffic, it is more difficult for adversaries to imitate the physical characteristics of ECUs, such as the mean squared error of voltage measurements [11].…”

Section: Accumulated Offsetmentioning

confidence: 99%

Shape of the Cloak: Formal Analysis of Clock Skew-Based Intrusion Detection System in Controller Area Networks

Xiang

Sagong

Clark

et al. 2019

IEEE Trans.Inform.Forensic Secur.

View full text Add to dashboard Cite

This paper presents a new masquerade attack called the cloaking attack and provides formal analyses for clock skewbased Intrusion Detection Systems (IDSs) that detect masquerade attacks in the Controller Area Network (CAN) in automobiles. In the cloaking attack, the adversary manipulates the message inter-transmission times of spoofed messages by adding delays so as to emulate a desired clock skew and avoid detection. In order to predict and characterize the impact of the cloaking attack in terms of the attack success probability on a given CAN bus and IDS, we develop formal models for two clock skew-based IDSs, i.e., the state-of-the-art (SOTA) IDS and its adaptation to the widely used Network Time Protocol (NTP), using parameters of the attacker, the detector, and the hardware platform. To the best of our knowledge, this is the first paper that provides formal analyses of clock skew-based IDSs in automotive CAN. We implement the cloaking attack on two hardware testbeds, a prototype and a real vehicle (the University of Washington (UW) EcoCAR), and demonstrate its effectiveness against both the SOTA and NTP-based IDSs. We validate our formal analyses through extensive experiments for different messages, IDS settings, and vehicles. By comparing each predicted attack success probability curve against its experimental curve, we find that the average prediction error is within 3.0% for the SOTA IDS and 5.7% for the NTP-based IDS.

show abstract

Intrusion detection system based on the analysis of time intervals of CAN messages for in-vehicle network

Cited by 362 publications

References 4 publications

GIDS: GAN based Intrusion Detection System for In-Vehicle Network

GIDS: GAN based Intrusion Detection System for In-Vehicle Network

Road Context-Aware Intrusion Detection System for Autonomous Cars

Shape of the Cloak: Formal Analysis of Clock Skew-Based Intrusion Detection System in Controller Area Networks

Contact Info

Product

Resources

About