Modern vehicles have multiple electronic control units (ECUs) that are connected together as part of a complex distributed cyber-physical system (CPS). The ever-increasing communication between ECUs and external electronic systems has made these vehicles particularly susceptible to a variety of cyber-attacks. In this work, we present a novel anomaly detection framework called TENET to detect anomalies induced by cyber-attacks on vehicles. TENET uses temporal convolutional neural networks with an integrated attention mechanism to learn the dependency between messages traversing the in-vehicle network. Post deployment in a vehicle, TENET employs a robust quantitative metric and classifier, together with the learned dependencies, to detect anomalous patterns. TENET is able to achieve an improvement of 32.70% in False Negative Rate, 19.14% in the Mathews Correlation Coefficient, and 17.25% in the ROC-AUC metric, with 94.62% fewer model parameters, and 48.14% lower inference time compared to the best performing prior works on automotive anomaly detection.

Modern vehicles can be thought of as complex distributed embedded systems that run a variety of automotive applications with real-time constraints. Recent advances in the automotive industry towards greater autonomy are driving vehicles to be increasingly connected with various external systems (e.g., roadside beacons, other vehicles), which makes emerging vehicles highly vulnerable to cyber-attacks. Additionally, the increased complexity of automotive applications and the in-vehicle networks results in poor attack visibility, which makes detecting such attacks particularly challenging in automotive systems. In this work, we present a novel anomaly detection framework called LATTE to detect cyber-attacks in Controller Area Network (CAN) based networks within automotive platforms. Our proposed LATTE framework uses a stacked Long Short Term Memory (LSTM) predictor network with novel attention mechanisms to learn the normal operating behavior at design time. Subsequently, a novel detection scheme (also trained at design time) is used to detect various cyber-attacks (as anomalies) at runtime. We evaluate our proposed LATTE framework under different automotive attack scenarios and present a detailed comparison with the best-known prior works in this area, to demonstrate the potential of our approach.

Today's vehicles are complex distributed embedded systems that are increasingly being connected to various external systems. Unfortunately, this increased connectivity makes the vehicles vulnerable to security attacks that can be catastrophic. In this article, we present a novel intrusion detection system (IDS) called INDRA that utilizes a gated recurrent unit (GRU)-based recurrent autoencoder to detect anomalies in controller area network (CAN) bus-based automotive embedded systems. We evaluate our proposed framework under different attack scenarios and also compare it with the best known prior works in this area.

Time-triggered automotive networks use time-triggered protocols (FlexRay, TTEthernet, etc.) for periodic message transmissions that often originate from safety and time-critical applications. One of the major challenges with time-triggered transmissions is jitter, which is the unpredictable delay-induced deviation from the actual periodicity of a message. Failure to account for jitter can be catastrophic in time-sensitive systems, such as automotive platforms. In this article, we propose a novel scheduling framework (JAMS-SG) that satisfies timing constraints during message delivery for both jitter-affected time-triggered messages and high-priority event-triggered messages in automotive networks. At design time, JAMS-SG performs jitter-aware frame packing (packing of multiple signals from Electronic Control Units (ECUs) into messages) and schedules synthesis with a hybrid heuristic. At runtime, a Multi-Level Feedback Queue (MLFQ) handles jitter-affected time-triggered messages and high-priority event-triggered messages that are scheduled using a runtime scheduler. Our simulation results, based on messages and network traffic data from a real vehicle, indicate that JAMS-SG is highly scalable and outperforms the best-known prior work in the area in the presence of jitter.

FlexRay is becoming a popular in-vehicle communication protocol for the next generation x-by-wire applications such as drive-by-wire and steer-by-wire. The protocol supports both time-triggered and event-triggered transmissions. One of the important challenges with time-triggered transmissions is jitter, which is the unpredictable delay-induced deviation from the actual periodicity of a message. Failure to account for jitter can be catastrophic for time critical automotive applications. In this paper we propose a novel scheduling framework (JAMS) that handles both jitter affected time-triggered messages and high priority event-triggered messages to ensure message delivery while satisfying timing constraints. At design time, JAMS handles packing of multiple signals from Electronic Control Units (ECUs) into messages, and synthesizes a schedule using intelligent heuristics. At runtime, a Multi-Level Feedback Queue handles jitter affected time-triggered messages, and high priority event-triggered messages. We also propose a runtime scheduler that packs these messages into the FlexRay static segment slots depending on available slack. Experimental analysis indicates that JAMS improves the response time by 25.3% on average and up to 41% compared to the best-known prior work in the area.