Electronic Control Units (ECUs) exchange data via in-vehicle network protocols such as the Controller Area Network (CAN) protocol. These protocols do not encrypt data or authenticate messages since they were designed for an isolated network. Many studies have developed Intrusion Detection Systems (IDSs) that fingerprint each ECU to secure the CAN protocol. These IDSs, however, cannot detect an attack in which an adversary spoofs sensor measurements or control signals in a message without changing the transmitter of that message. In order to detect such attacks, we develop a motion-based IDS (MIDS) that exploits the correlation between messages that convey the same information of a vehicle’s movement, such as vehicle speed. We also introduce a new metric to quantify the effectiveness of MIDS. We evaluate MIDS using CAN data from two real vehicles by demonstrating that MIDS can detect the attacks on the CAN bus or ECUs.


    Access

    Download


    Export, share and cite



    Title :

    Inter-message correlation for intrusion detection in controller area networks



    Publication date :

    2019-10-31


    Type of media :

    Article/Chapter (Book)


    Type of material :

    Electronic Resource


    Language :

    English


    Keywords :

    Classification :

    DDC:    004 / 629




    Graph-Based Intrusion Detection System for Controller Area Networks

    Islam, Riadul / Refat, Rafi Ud Daula / Yerram, Sai Manikanta et al. | IEEE | 2022



    A Survey of Network Intrusion Detection Systems for Controller Area Network

    Dupont, Guillaume / den Hartog, Jerry / Etalle, Sandro et al. | IEEE | 2019


    Secure Intrusion Detection by Differentially Private Federated Learning for Inter-Vehicle Networks

    Xu, Qian / Zhang, Lei / Ou, Dongxiu et al. | Transportation Research Record | 2023


    A Delay based Plug-in-Monitor for Intrusion Detection in Controller Area Network

    Wang, Qian / Qian, Yiming / Lu, Zhaojun et al. | IEEE | 2018