Cyberattacks on In-Vehicle Networks (IVNs) are becoming the most urgent issue. The Controller Area Network (CAN), one of the IVNs, is a standard protocol for automotive networks. Many researchers have tackled the security issues of CAN, such as the vulnerability of Denial-of-Service (DoS) attacks and impersonation attacks. Though existing methods can prevent DoS attacks, they have problems in deployment cost, isolability of a compromised Electronic Control Unit (ECU), and traceability for the root cause of isolation. Thus, we tackle to prevent DoS attacks on CAN. To solve these problems of the existing methods, we propose an isolable and traceable CAN-bus kernel-level protection called IVNPROTECT. IVNPROTECT can be installed on an ECU, which has a wireless interface, just by the software updating because it is implemented in the CAN-bus kernel driver. We also confirm that our IVNPROTECT can mitigate two types of DoS attacks without distinguishing malicious/benign CAN identifie rs. After mitigating DoS attacks, IVNPROTECT isolates a compromised ECU with a security error state mechanism, which handles security errors in IVNPROTECT. And, we evaluate the traceability that an ECU with IVNPROTECT can report warning messages to the other ECUs on the bus even while being forced to send DoS attacks by an attacker. In addition, the overhead of IVNPROTECT is 9.049 $00B5s, so that IVNPROTECT can be installed on insecure ECUs with a slight side-effect.

The Controller area network (CAN) is the most extensively used in-vehicle network. It is set to enable communication between a number of electronic control units (ECU) that are widely found in most modern vehicles. CAN is the de facto in-vehicle network standard due to its error avoidance techniques and similar features, but it is vulnerable to various attacks. In this research, we propose a CAN bus intrusion detection system (IDS) based on convolutional neural networks (CNN). U-CAN is a segmentation model that is trained by monitoring CAN traffic data that are preprocessed using hamming distance and saliency detection algorithm. The model is trained and tested using publicly available datasets of raw and reverse-engineered CAN frames. With an$F_{1} {Score}$of 0.997, U-CAN can detect DoS, Fuzzy, spoofing gear, and spoofing RPM attacks of the publicly available raw CAN frames. The model trained on reverse-engineered CAN signals that contain plateau attacks also results in a true positive rate and false-positive rate of 0.971 and 0.998, respectively.

Recently, cyberattacks on Controller Area Network (CAN) which is one of the automotive networks are becoming a severe problem. CAN is a protocol for communicating among Electronic Control Units (ECUs) and it is a de-facto standard of automotive networks. Some security researchers point out several vulnerabilities in CAN such as unable to distinguish spoofing messages due to no authentication and no sender identification. To prevent a malicious message injection, at least we should identify the malicious senders by analyzing live messages. In previous work, a delay-time based method called Divider to identify the sender node has been proposed. However, Divider could not identify ECUs which have similar variations because Divider's measurement clock has coarse time-resolution. In addition, Divider cannot adapt a drift of delay-time caused by the temperature drift at the ambient buses. In this paper, we propose a super fine delay-time based sender identification method with Time-to-Digital Converter (TDC). The proposed method achieves an accuracy rate of 99.67% in the CAN bus prototype and 97.04% in a real-vehicle. Besides, in an environment of drifting temperature, the proposed method can achieve a mean accuracy of over 99%.

Controller Area Network (CAN) is one of the in-vehicle network protocols that is used to communicate among Electronic Control Units (ECUs) and has been de-facto standard. CAN is simple and has several vulnerabilities such as unable to distinguish spoofing messages because it doesn't support any authentication or sender identification properties. In previous work, some voltage-based methods to identify the sender node have been proposed. The methods can identify ECUs with high accuracy. However, the accuracy of source identification depends on a feature that is extracted from a continuous function of voltage use sampling. In general, as the sampling rate increases, the accuracy of identification is improved. Though the amount of data used for the identification increases too. Hence, it is desired to create an Intrusion Detection System (IDS) that identifies ECUs using few sampling features as there is a limited computing resource in vehicles. In this paper, we propose a delay-time based sender identification method of ECUs. We confirm that the proposed method achieved a true positive rate of 96.7% in CAN bus prototype against spoofing attack from a compromised ECU, detecting spoofing attack from an unmonitored ECU with a true positive rate of 98.0% in real-vehicle.