Normal and Malicious Sliding Windows Similarity Analysis Method for Fast and Accurate IDS Against DoS Attacks on In-Vehicle Networks

Abstract

Controller Area Network (CAN) is a de facto standard of in-vehicle networks. Since CAN employs broadcast communication and a slower network than other general networks (e.g. Ethernet, IEEE802.11), it is inherently vulnerable to Denial-of-Service (DoS) attacks. As a countermeasure against DoS attacks on CAN, a method for detecting a DoS attack using the entropy in a sliding window has been proposed. This method has a good advantage in terms of effectiveness and the small computational overhead. However, this method may only be effective against DoS attacks under naive conditions such as some higher priority messages. In addition, if an adversary can adjust the entropy of the DoS attack to its normal value, the conventional method cannot detect a DoS attack in which the adversary manipulates the entropy. We found this type of DoS attack, which is called an entropy-manipulated attack. In this paper, we propose a method that can detect an entropy-manipulated attack by using the similarity of two sliding windows. We confirmed that the proposed method detected the DoS attack in 100% of the cases in our experiment, and we showed that the detection time is up to 93% (14 µs) shorter than the conventional method.INDEX TERMS Automotive security, controller area network, DoS attack, intrusion detection system, simulated annealing.

Intrusion Detection System CAN-Bus In-Vehicle Networks Based on the Statistical Characteristics of Attacks

“…In 2020, Ohira et al [ 18 ] used the offline learning phase to determine the similarity values for various window sizes. They demonstrated that changing the sliding window size affects the similarity values.…”

“…However, most IDS have not selected the optimal values for these parameters for intrusion detection. Motivated by this, we investigated into obtaining optimally tuned IDS parameters in order to maximize IDS detection and address the limitations in [ 18 , 19 , 20 , 21 , 22 , 23 ]. We focus on a system model in which ECUs take measurements in real-time and send the results to a service-oriented gateway via different types of CAN buses.…”

Android Head Units vs. In-Vehicle ECUs: Performance Assessment for Deploying In-Vehicle Intrusion Detection Systems for the CAN Bus

“…However, most of these studies focus only on the detection accuracy and do not take into account the computational constraints which are crucial in the context of automotive embedded platforms -these constraints are the main focus in our work. In what follows we survey more than twenty-five papers related to the development of in-vehicle IDS, but only a small amount of them, namely [18], [19], [20], [21] and [22] are using embedded development boards. Also, a comparison between invehicle controllers and Android units that are now common in cars is missing from related works.…”

“…The proposed mechanism was implemented and validated on a Raspberry Pi, using the one-class support vector machine and the isolation forest algorithms for intrusion detection. The authors of [22] present a method to detect DoS attacks using the similarity of sliding windows. This method improves prior approaches that detect DoS attacks based on the entropy in a sliding window.…”

CPS Attacks Mitigation Approaches on Power Electronic Systems With Security Challenges for Smart Grid Applications: A Review

“…Meanwhile, the MITM attack occurs in the communication links [151]. In the case of signal jamming, which may lead to an interruption in transmitting the signals, this attack is known as DoS attack [152].…”