Due to its cost efficiency the Controller Area Network (CAN) is still the most wide-spread in-vehicle bus and the numerous reported attacks demonstrate the urgency in designing new security solutions for CAN. In this work we propose an intrusion detection mechanism that takes advantage of Bloom filtering to test frame periodicity based on message identifiers and parts of the data-field which facilitates detection of potential replay or modification attacks. This proves to be an effective approach since most of the traffic from in-vehicle buses is cyclic in nature and the format of the data-field is fixed due to rigid signal allocation. Bloom filters provide an efficient time-memory tradeoff which is beneficial for the constrained resources of automotive grade controllers. We test the correctness of our approach and obtain good results on an industry-standard CANoe based simulation for a J1939 commercial-vehicle bus and also on CAN-FD traces obtained from a real-world high-end vehicle. The proposed filtering mechanism is straight-forward to adapt for any other time-triggered in-vehicle bus, e.g., FlexRay, since it is built on time-driven characteristics.

Vehicles cannot be secured while the in-vehicle network remains insecure. The growing number of attacks reported each year shows that in-vehicle buses are not isolated from the outside world. By exploiting their lack of security, adversaries can gain control over virtually any functionality inside the car. We discuss the most promising approaches for assuring security on the controller area network (CAN) bus after a decade of attacks and security proposals. Most of the proposals are based on cryptographic mechanisms, but some exploit the physical layer or even the physical characteristics of the controllers. The surveyed solutions prove a significant degree of maturity and sophistication, which suggests that the moment for adoption and standardization by the industry has come.

In the recent years, countless security concerns related to automotive systems were revealed either by academic research or real life attacks. While current attention was largely focused on passenger cars, due to their ubiquity, the reported bus-related vulnerabilities are applicable to all industry sectors where the same bus technology is deployed, i.e., the CAN bus. The SAE J1939 specification extends and standardizes the use of CAN to commercial vehicles where security plays an even higher role. In contrast to empirical results that attest such vulnerabilities in commercial vehicles by practical experiments, here we determine that existing shortcomings in the SAE J1939 specifications open road to several new attacks, e.g., impersonation, DoS, DDoS, etc. Taking advantage of an industry-standard CANoe based simulation, we demonstrate attacks with potential safety critical effects that are mounted while still conforming to the SAE J1939 standard specification. We discuss countermeasures and security enhancements by including message authentication mechanisms. Finally, we evaluate and discuss the impact of employing these mechanisms on the overall network communication.

We fingerprint 54 ECUs from 10 cars, one of them being a heavy-duty vehicle that is compliant to the SAE J1939 standard. These later specifications implemented in commercial vehicles offer concrete sender addresses in every CAN frame, making physical characteristics easier to link to specific ECUs. This is not the case for traffic collected inside passenger cars where the allocation of CAN bus identifiers is non-uniform, without explicit sender and receiver addresses, making ECU identification more challenging. While previous research has shown good separation between ECUs even when single features are used, e.g., skews or maximum voltage level, prior results are based on a small number of cars, while our larger experimental basis proves that single features are likely insufficient to separate between a large number of ECUs. Concretely, for a crisp separation, at least four features seem to be needed, i.e., mean voltage, max voltage, bit time and plateau time, while clock skews or any single voltage feature lead to overlaps. We provide clear experimental bounds on the intra and inter-distances regarding skews and voltage features, not neglecting environmental variations which may occur when the car is running.

The Controller Area Network (CAN), which is used for communication between in-vehicle devices, has been shown to be vulnerable to spoofing attacks. Voltage-based spoofing detection (VBS-D) mechanisms are considered state-of-the-art solutions, complementing cryptography-based authentication whose security is limited due to the CAN protocol’s limited message size. Unfortunately, VBS-D mechanisms are vulnerable to poisoning performed by a malicious device connected to the CAN bus, specifically designed to poison the deployed VBS-D mechanism as it adapts to environmental changes that take place when the vehicle is moving. In this paper, we harden VBS-D mechanisms using a deep learning-based mechanism which runs immediately, when the vehicle starts; this mechanism utilizes physical side-channels to detect and locate physical intrusions, even when the malicious devices connected to the CAN bus are silent. We demonstrate the mechanism’s effectiveness (100% intrusion detection accuracy and error rates of close to 0%) in various physical intrusion scenarios and varying temperatures on a CAN bus prototype. In addition, we present a deep learning-based VBS-D mechanism that securely adapts to environmental changes. This mechanism’s robustness (99.8% device identification accuracy) is demonstrated on a real moving vehicle.

Since the first reports on its lack of security, the Controller Area Network (CAN) was in focus for numerous research works. A specific area of research has employed physical layer characteristics that can be used to uniquely identify network nodes. But there are common downsides in existing approaches such as vulnerabilities in front of attacks involving node replacement or insertion or the inability to locate the intruder node within the network. In this work, we propose a new intrusion detection system for CAN which is based on monitoring the propagation time of the physical signals sent on the bus. Indeed, quite a number of recent works addressed the use of physical or timing characteristics to identify network nodes or to create covert channels. In our approach, by accounting for intrinsic delay characteristics of the bus and by monitoring the difference in signal arrival time at the two bus ends, we can identify nodes by location-related differential delays and provide relevant information for estimating the relative location of a transmitter node on the bus. The results of our experimental evaluation show that our approach provides very high identification rates and accurate localization in case of attacks from compromised nodes. The ability to detect attacks that replace an existing node or plug new adversarial nodes on the bus is also illustrated along with discussions on estimating sender location in these cases.