Intrusion prevention system of automotive network CAN bus

Abbott-McCune, Sam; Shay, Lisa A.

doi:10.1109/ccst.2016.7815711

Cited by 33 publications

(14 citation statements)

References 1 publication

Supporting

Mentioning

Contrasting

Order By: Relevance

“…[Abbott- McCune and Shay 2016] propose a solution capable of evolving to a working IPS [Abbott-McCune and Shay 2016]. It consists of checking whether the arbitration ID of a CAN frame matches the ones pre-programmed in the ECU and also if the ECU is transmitting data at the same time, thus detecting if a malicious node is trying to replay a message.…”

Section: Related Workmentioning

confidence: 99%

“…An IDS can detect attacks, but it is not capable of preventing it. [Abbott-McCune and Shay 2016] and [Giannopoulos et al 2017] suggest inserting a bit stuffing error during malicious frame transmission in order to prevent it from being successfully transmitted throughout the network. The IDS must respond fast enough in order to generate the bit stuffing error while the malicious frame is still being transmitted, The purpose of this paper is to present an IDS capable of detecting anomalies in an automotive CAN network before the end of the transmission of a CAN frame.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

A Real-time Anomaly-based Intrusion Detection System for Automotive Controller Area Networks

D'Andrada¹,

Araujo-Filho²,

Campelo³

2020

Anais XXXVIII Simpósio Brasileiro De Redes De Computadores E Sistemas Distribuídos (SBRC 2020)

View full text Add to dashboard Cite

The Controller Area Network (CAN) is the most pervasive in-vehiclenetwork technology in cars. However, since CAN was designed with no securityconcerns, solutions to mitigate cyber attacks on CAN networks have been pro-posed. Prior works have shown that detecting anomalies in the CAN networktraffic is a promising solution for increasing vehicle security. One of the mainchallenges in preventing a malicious CAN frame transmission is to be able todetect the anomaly before the end of the frame. This paper presents a real-timeanomaly-based Intrusion Detection System (IDS) capable of meeting this dead-line by using the Isolation Forest detection algorithm implemented in a hardwaredescription language. A true positive rate higher than 99% is achieved in testscenarios. The system requires less than 1μs to evaluate a frame’s payload, thusbeing able to detect the anomaly before the end of the frame.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

A Real-time Anomaly-based Intrusion Detection System for Automotive Controller Area Networks

D'Andrada¹,

Araujo-Filho²,

Campelo³

2020

Anais XXXVIII Simpósio Brasileiro De Redes De Computadores E Sistemas Distribuídos (SBRC 2020)

View full text Add to dashboard Cite

show abstract

“…To secure vehicular environments, two different approaches have been considered: security countermeasures based on encryption and authentication for data over vehicular networks, and intrusion detection systems that can detect suspicious activities on the networks [ 18 , 19 , 20 , 21 , 22 , 23 , 24 , 25 , 26 , 27 ]. In this work, we focus on the intrusion detection system based on the estimation of the Rényi entropy with multiple orders [ 28 ].…”

Section: Introductionmentioning

confidence: 99%

A Multiple Rényi Entropy Based Intrusion Detection System for Connected Vehicles

Kim

Lim

et al. 2020

Entropy

View full text Add to dashboard Cite

In this paper, we propose an intrusion detection system based on the estimation of the Rényi entropy with multiple orders. The Rényi entropy is a generalized notion of entropy that includes the Shannon entropy and the min-entropy as special cases. In 2018, Kim proposed an efficient estimation method for the Rényi entropy with an arbitrary real order α . In this work, we utilize this method to construct a multiple order, Rényi entropy based intrusion detection system (IDS) for vehicular systems with various network connections. The proposed method estimates the Rényi entropies simultaneously with three distinct orders, two, three, and four, based on the controller area network (CAN)-IDs of consecutively generated frames. The collected frames are split into blocks with a fixed number of frames, and the entropies are evaluated based on these blocks. For a more accurate estimation against each type of attack, we also propose a retrospective sliding window method for decision of attacks based on the estimated entropies. For fair comparison, we utilized the CAN-ID attack data set generated by a research team from Korea University. Our results show that the proposed method can show the false negative and positive errors of less than 1% simultaneously.

show abstract

“…For example, the Controller Area Network (CAN) bus is another communication protocol widely used in the automotive sector. However, it can be compromised, and some intrusion prevention systems have been proposed . In this sense, there are security frameworks using the AES.…”

Section: Introductionmentioning

confidence: 99%

Analysing encryption mechanisms and functional safety in a ROS‐based architecture

Larrucea

González-Nalda

Etxeberria‐Agiriano

et al. 2019

J Software Evolu Process

View full text Add to dashboard Cite

Robot Operating System (ROS) is a middleware for connecting different components of robots. However, its use is becoming more popular in other domains such as in the automotive sector where initial prototypes have been customized and deployed in cars for demonstrating different functional purposes. Nevertheless, ROS has not been yet tested enough to be used in secure and safety environments. For example, in order to strengthen our ROS architecture, we have encrypted the messages within it. Therefore, this paper analyses the impact of Advanced Encryption Standard (AES) encryption mechanism and the functional safety of our prototype. In this sense, we are considering encrypting messages and we assess the timing constraints, as suggested by the ISO 26262, required for assuring a secure communication between components.

show abstract

Intrusion prevention system of automotive network CAN bus

Cited by 33 publications

References 1 publication

A Real-time Anomaly-based Intrusion Detection System for Automotive Controller Area Networks

A Real-time Anomaly-based Intrusion Detection System for Automotive Controller Area Networks

A Multiple Rényi Entropy Based Intrusion Detection System for Connected Vehicles

Analysing encryption mechanisms and functional safety in a ROS‐based architecture

Contact Info

Product

Resources

About