As vehicular functions become increasingly computerized for the safety and convenience of drivers, the attack surfaces on a vehicle keep increasing accordingly. Many attack results have shown that an attacker could intentionally control vehicles. Most of the attackers exploit the vulnerability, that is, the controller area network (CAN) protocol, which is a de facto standard for the in-vehicle network communication and does not support message origin authentication. Although a number of methods have been suggested to resolve this security vulnerability, each method has its limitations in being applied to the current system. They require the modification of the CAN standard or a dramatical communication load increase, which is infeasible in practice. In this paper, we propose a novel identification method, which works in the physical layer of the in-vehicle CAN network. Our method identifies electronic control units (ECUs) by using inimitable characteristics of electrical CAN signals enabling detection of a malicious ECU. Unlike previous attempts to address the security problem in the in-vehicle CAN network, our method works by simply adding a monitoring unit to the existing network, making it deployable in current systems and compliant with required CAN standards. Our experimental results show that our method is able to correctly identify ECUs. Regarding the misclassification rate for ECU identification, our method yields 0.36% on average; this is approximately four times lower than that obatained by the method proposed by P.-S. Murvay et al. This paper is also the first to identify the potential attack models that systems should be able to detect.

The development of vehicle technologies such as connected and autonomous vehicle environments provide drivers with functions for convenience and safety that are highly capable of remote vehicle diagnosis or lane-keeping assistance. Unfortunately, despite impressive advantages for drivers, these functions also have various vulnerabilities that could lead to cyber-physical attacks on automotive Controller Area Networks (i.e., automotive CAN). To deal with these security issues, a multitude of issue-specific countermeasures have already been proposed. In this paper, we introduce existing research on automotive CAN attacks and evaluate several state-of-the-art countermeasures. Particularly, we provide a comprehensive adversary model for automotive CAN and classify existing countermeasures into four system categories: (1) preventative protection, (2) intrusion detection, (3) authentication, and (4) post-protection. From the extensive literature review, we attempt to summarize the security research regarding automotive CAN and identify open research directions for in-vehicle networks of autonomous vehicle.

Recently, numerous electronic components are installed in vehicles, providing drivers and passengers with increased safety and convenience. The electronic components construct an in-vehicle network that internally shares relevant status information about the vehicle. As modern vehicles become more computerized, the potential for automotive cyber-security threats also increases a fact that has been illustrated clearly by various car-hacking demonstrations. Using the controller area network (CAN), the de facto standard protocol in the automotive industry that facilitates in-vehicle network communication, car-hacking demonstrations inject critical CAN messages to control vehicular functions. In efforts to address this security issue, car manufacturers, in turn, have made confidential the CAN database (i.e., DBC format file), where signal information assigned in the CAN data payload is specified. However, it has since become known that this policy does not hermetically seal a vehicular network against cyber attacks. On the contrary, in-depth automotive security research has been hindered significantly because of the limited information accessible by researchers. For example, automotive intrusion detection systems (IDS) identify and alert when there is a vehicular break-in, and this technology is a major area of study in automotive cyber security research. For the automotive IDS that analyzes CAN traffic, information in the DBC format file greatly improves detection veracity. However, most IDS technologies to date have been independently developed without the confidential CAN DB information and, as a result, do not mitigate threats to a satisfactory standard. In this paper, we propose an enhanced method that identifies signal boundaries in a CAN data payload, which is specified in the DBC format file. Unlike an existing method that is designed based on total bit-flip rates, our method analyzes bit-flip time series not total bit-flip rates so that signal boundaries can be more clearly identified. In this paper, we use a publicly available DBC format file called OpenDBC as a reference, and show that our method outperforms the existing method.

Background: Nonpharmaceutical interventions (NPIs) such as mask-wearing and social distancing during the COVID-19 pandemic significantly reduced the transmission of common respiratory viruses, including influenza virus and respiratory syncytial virus (RSV). As NPIs were stopped, concerns emerged about “immunity debt,” which suggests that limited natural exposure to pathogens may have increased susceptibility and severity, particularly among young children. However, despite growing attention, the postpandemic impact of NPIs on epidemiologic patterns and shifts in age-specific disease burden remains underexplored. Objective: This study aims to investigate, using national surveillance data, the repercussions of the COVID-19 pandemic on the epidemiology and clinical burden of influenza virus and RSV infections in Korea, with an emphasis on the influence of NPIs on the incidence and clinical severity of these infections, particularly among young children. Methods: We analyzed weekly virologic, outpatient, and inpatient surveillance data on influenza virus and RSV infections from the Korea Disease Control and Prevention Agency from 2017 to 2024, covering the prepandemic, pandemic, and postpandemic periods. Time-series analyses were conducted to examine changes in seasonality and to estimate age-specific incidence and clinical severity of influenza virus and RSV infections before and after the COVID-19 pandemic. Results: In the postpandemic seasons, both RSV and influenza virus infections showed disrupted seasonality with delayed and prolonged epidemics. While the overall burden of both viruses was comparable to that for prepandemic periods, there was a notable shift in the age distribution of severe cases. Among influenza–associated hospital admissions, the proportion of school-aged children (7‐18 years) doubled, rising from 14% (1,814/12,660) in 2019/20 to 28% (2,176/7,755) in 2022/23. Hospitalization rates in this age group also increased significantly, from 46.8 to 64.4 per 100,000 among children aged 7‐12 years, and from 16.4 to 30.0 per 100,000 among those aged 13‐18 years. For RSV infections, the burden shifted most prominently to young children aged 1‐6 years, whose share of hospital admissions rose from 48% (5,789/11,969) to 61% (7,316/12,011) over the same period. This age group also experienced the largest rise in RSV-associated hospitalization rates, increasing from 230.8 to 357.5 per 100,000 between the 2019/20 and 2022/23 seasons. Conclusions: The patterns of influenza virus and RSV infections in Korea following the COVID-19 pandemic reveal distinct shifts in timing, severity, and the age groups that were most affected. Postpandemic influenza and RSV activity in Korea showed delayed and prolonged epidemics, with shifts in age-specific disease burden rather than an overall increase. Substantial increases in susceptibility and severity among young children for RSV infections and older children for influenza virus infections suggest lingering immunity gaps from reduced exposures during the pandemic. These effects may be further compounded by declining influenza vaccine uptake among children following the pandemic. Our findings underscore the importance of ongoing surveillance and targeted public health measures to manage respiratory viruses in the postpandemic era.

Modern vehicles are becoming complex cyber-physical systems equipped with numerous electronic control units (ECUs). Over the controller area network (CAN), these ECUs communicate with each other to share information related to vehicle status as well as commands to efficiently control the vehicle. However, the increasing complexity of modern vehicles has inadvertently expanded potential attack surfaces, making them vulnerable to cyber attacks. In light of this, researchers are currently working to demonstrate remote vehicle maneuvering by compromising ECUs, and as a countermeasure to such malicious manipulation, to study automotive intrusion detection systems (IDSs) as potential remedies. In general, CAN messages are transmitted periodically, and as such, many researchers have relied on frequency-based IDSs in their solutions proposals. However, an attacker can bypass this defense by suspending the communication of the target ECU from the network and injecting malicious messages with the same frequency as the suspended messages. As a result, an attacker is able to masquerade as the original transmission frequency. In this paper, we propose a Transmission-resuming Time-based IDS (TTIDS), which is designed to detect such attacks. TTIDS detects when an ECU periodically transmitting messages is suspended, and then it estimates when the suspended ECU resumes periodic transmission. With this projection, TTIDS detects malicious messages transmitted while the ECU is suspended. We conduct the evaluation of TTIDS on two real vehicles and present the results, which show the TTIDS is able to effectively detect an enhanced attack that bypasses existing frequency-based IDSs with a false positive rate of 0.213% and a false negative rate of 0.027%.