In-Vehicle networks such as the Controller Area Network (CAN) are highly vulnerable to cyberattacks due to the absence of encryption and authentication mechanisms. Intrusion detection systems (IDSs) have therefore become a critical line of defense. Among them, graph-based IDSs that model message sequences as graphs have attracted attention for their effectiveness against attacks that disrupt communication structures. However, replication experiments show that a representative method, GDTIDS, performs poorly against masquerade attacks, which preserve structural properties while manipulating payload contentsTo address this limitation, we propose a new feature, the outlier ratio, which incorporates payload-level information into the IDS. We define three variants of the feature based on value range, Hamming distance, and Mahalanobis distance. Evaluations on three publicly available CAN datasets demonstrate that the proposed method, particularly the Mahalanobis-Distance based variant, significantly improves detection of masquerade attacks while maintaining high performance against other attack types.

Time-sensitive networking (TSN), as a solution to the nondeterministic communication of traditional Ethernet, meets the real-time and deterministic communication requirements of intelligent automobiles. There are three traffic types in intelligent automobiles, including time-triggered (TT) flows, audio-video-bridging (AVB) flows, and best-effort (BE) flows, and TSN proposes the gate control list (GCL) to control the transmission of the above traffic. The current GCL synthesis usually serves the hard real-time TT flows but ignores the delay of non-TT flows; and it introduces guard bands to ensure the noninterference transmission of TT flows, inevitably wasting bandwidth. Therefore, this article proposes a design synthesis and optimization strategy to improve the transmission of AVB flows and bandwidth utilization while ensuring the real-time performance of TT flows. This strategy first adopts the initial time window design to allocate the antecedent time windows for AVB flows, then transmits AVB flows according to the deadline to enhance the scheduling of AVB flows, and finally flexibly adjusts the time windows of TT flows and AVB flows according to the size of AVB flows to improve bandwidth utilization. Experimental results show the effectiveness of the proposed strategy in improving the transmission of AVB flows and bandwidth utilization compared to the state-of-the-art methods.

Multiple controller area network (CAN) buses are often integrated in in-vehicle networks to support various functions and control systems. Although the CAN-CAN gateway has a critical role in relaying messages between these buses, it increases the end-to-end (E2E) delay of messages. This study proposes a method for reducing the E2E delay of messages transmitted through a CAN-CAN gateway by changing their CAN IDs. The E2E delay of gateway messages is minimized using a simulated annealing algorithm. An evaluation of the proposed method demonstrates that it can significantly reduce the E2E delay of gateway messages compared to that obtained with methods in which CAN IDs remain unchanged or are randomly altered and a method that uses the Targeted Priority Assignment algorithm.

The importance of methods for detecting anomalies, such as threats to automotive cybersecurity, in the in-vehicle networks has been increasing. Particularly crucial is the detection of hijackings of vehicle electronic control units (ECUs) by attackers. However, methods for detecting anomalies in hijacked ECUs have not been sufficiently developed. Therefore, this study proposes an ECU hijacking detection method that uses a trust model executed by each ECU. The proposed method aims to detect abnormal behavior by having all ECUs monitor each other. This study demonstrated the ability of the proposed method to detect anomalies in hijacked ECUs and their systems.

Time-Sensitive Networking (TSN) realizes high bandwidth and time determinism for data transmission and thus becomes the crucial communication technology in time-critical systems. The Gate Control List (GCL) is used to control the transmission of different classes of traffic in TSN, including Time-Triggered (TT) flows, Audio-Video-Bridging (AVB) flows, and Best-Effort (BE) flows. Most studies focus on optimizing GCL synthesis by reserving the preceding time slots to serve TT flows with the strict delay requirement, but ignore the deadlines of non-TT flows and cause the large delay. Therefore, this paper proposes a comprehensive scheduling method to enhance the real-time scheduling of AVB flows while guaranteeing the time determinism of TT flows. This method first optimizes GCL synthesis to reserve the preceding time slots for AVB flows, and then introduces the Earliest Deadline First (EDF) method to further improve the transmission of AVB flows by considering their deadlines. Moreover, the worst-case delay (WCD) analysis method is proposed to verify the effectiveness of the proposed method. Experimental results show that the proposed method improves the transmission of AVB flows compared to the state-of-the-art methods.

The CAN FD emerges as a promising CAN technology inside the ACPS due to its advantages of high data-phase bit-rate and message payload. HSM based security solution is recommended by auto industry to protect CAN FD from potential security attacks, but it induces new challenges on timing analysis of CAN FD messages, which is left open in the literature. This article develops the first security-aware system model to describe the processing of CAN FD messages, and presents a new WCRT analysis to bound the interference induced by security-critical messages. We give the theoretical proof that our WCRT analysis can upper bound the response time of CAN FD messages. Using a small message set, we show that the WCRT computed by our new analysis is only 14% percent higher than the true WCRT obtained from an exhaustive search based simulator. By comparing with existing method, the number of impacted messages increases along with the increasing number of security critical messages, and for the two typical CAN FD systems, the percentage of WCRT increase varies from 12.43% to 14.57% and 7.0% to 10.89%, respectively; the percentage of WCRT decrease varies from 3.29% to 6.04% and 4.13% to 7.93%, respectively.

In recent years, research and hacking verification experiments have been conducted on cybersecurity countermeasures in vehicles. However, establishing digital forensics technology related to vehicle hacking remains a problem for clarifying the facts, methods, and effects when hacking via an in-vehicle network actually occurs. Digital forensics refers to the methods and procedures for handling digital information recorded on digital devices or elsewhere without loss of evidentiary value, and is regarded as important by various law enforcement agencies, including the police. Some vehicles are already fitted with an event data recorder (EDR) that records the vehicle state, and digital forensics is performed on the EDR when a vehicle accident occurs. The present study surveyed and performed experiments on EDRs, and verified that information related to evidence of hacking can be obtained in addition to conventional information about a traffic accident. Furthermore, this paper discusses security measures for the EDR are discussed from the perspective of performing digital forensics.

Extensibility is an important optimization objective for the E/E architecture of automotive cyber-physical systems (ACPS), while little attention has paid to the extensibility-aware design of in-vehicle network. To address this problem, this paper formulates a trade-off problem that balances the bandwidth utilization and the extensibility from the initial design of CAN FD. We firstly propose a new extensibility model and the related evaluation metric, and then two optimization algorithms, namely, the mixed integer linear programming (MILP) approach and the simulated annealing (SA) based heuristic approach, are proposed to resolve the trade-off problem for mid-sized and industry sized signal sets, respectively. The experiment results show the efficiency of the proposed extensibility metric and the optimization algorithms. By comparing with state-of-the-art algorithm, the MILP reduces the increase range of the bandwidth utilization of the extended signal set by 18.17% to 57.64% averagely, and 49.22% to 89.40% maximally, with only 0.06% to 0.79% bandwidth utilization overhead; the SA approach can reduces the increase range of the bandwidth utilization of the extended signal set by 12.71% to 58.33% averagely, and 40.08% to 89.40% maximally, with only 0.06% to 0.8% bandwidth utilization overhead.

To achieve high traceability from requirements to test scenarios, a test scenario generation method has been widely recognized as being an integral aspect of model-based development. However, it is difficult to make effective test scenarios that have sufficient requirement coverage including hazardous conditions. In this study, we propose a test scenario generation method from formalized functional requirements. Based on results from a hazard analysis, this technique is able to generate the scenario that reveals hazardous situations by specifying a hazardous state as the end-state of a scenario. Furthermore, by modeling attack targets and methods, test scenarios leading to a hazardous state by malicious simultaneous external attacks are generated. A parallelization technique for generating simultaneous attack test scenarios is shown. Using the exhaustive path-finding approach, our results show the ability to achieve high requirement coverage compared to the existing approaches. The proposed method uses a model checking method and cannot escape from the state explosion. However, it is able to reach real problems by modeling the highly-abstract requirement areas and specifying partial scenarios.

To realize the optimized design of the automotive cyber-physical system, it is required to consider the interplay between the communication and computation. However, the existing research about the design of the controller area network (CAN) with flexible data rate (CAN FD) ignores this, it only considers the minimization of the bandwidth utilization and neglects the fact that it would trigger too many unnecessary message receiving interrupts (MRIs) on message receiving electronic control units. To address this problem, this article formulates a tradeoff problem that balances the bandwidth utilization and the number of unnecessary MRIs during the design of the CAN FD. We first propose an algorithm to analyze the number of unnecessary MRIs triggered by the packed messages, and then, two heuristic algorithms, namely, the Top-Down approach and the Hybrid approach, are proposed to resolve the tradeoff problem for midsized and large signal sets, respectively. The experiment results show that compared with the state-of-the-art algorithm, the Top-Down approach reduces the unnecessary MRIs by 10.48%-99.89% with only 0.02%-1.32% bandwidth utilization overhead, the Hybrid approach reduces the unnecessary MRIs by 23.15%-99.63% with only 0.13%-2.07% bandwidth utilization overhead.

To achieve high traceability from requirements to test scenarios, a test scenario generation method has been widely recognized as being an integral aspect of model-based development. In this study, we propose a test scenario generation method from formalized functional requirements which employs the approach with the "fluent" proposition. Based on results from a hazard analysis, this technique is able to generate test scenarios that reveals hazardous situations by specifying a hazardous state as their end-state of a scenario. Furthermore, by modeling attack targets and methods, test scenarios leading to a hazardous state by malicious external attacks are generated.

Numerous examples of automotive vulnerabilities have been provided, and the diagnostic functions in the on-board electronic control unit (ECU) have been used as an avenue of attack and analysis. Many ECUs are equipped with security access services that protect crucial diagnostic functions. If these security access services contain vulnerabilities, however, the ECU may be falsified or improperly controlled through the controller area network. In this study, we analyze the means of attacking security access services and provide the results of evaluating actual ECUs.

We study the worst case response time (WCRT) analysis and evaluation for sporadic message-processing tasks in a multicore automotive gateway of a controller area network (CAN) cluster. We first build a multicore automotive gateway on CAN clusters. Two WCRT analysis methods for message-processing tasks in the multicore gateway are subsequently presented based on global and partitioned scheduling paradigms. We evaluate the WCRT results of two analysis methods with real message sets provided by the automaker, and present the design optimization guide.

A typical automotive integrated architecture is a controller area network (CAN) cluster integrated by a central gateway. This study proposes a novel and exact worst-case response time (WCRT) analysis method for message-processing tasks in the gateway. We first propose a round search method to obtain lower bound on response time (LBRT) and upper bound on response time (UBRT), respectively. We then obtain the exact WCRT belonging to the scope of the LBRT and UBRT with an effective non-exhaustive exploration. Experimental results on a real CAN message set reveal that the proposed exact analysis method can reduce 99.99999% combinations on large-scale CAN clusters.

The controller area network with flexible data-rate (CAN FD) is the new generation of the CAN technology to meet the daily increasing bandwidth requirement for automotive cyber-physical systems (ACPS). However, ACPS is a security-critical system, an efficient security/timing-aware design space exploration (DSE) method is required to fully utilize CAN FD's high data phase data rate. In this paper, we propose an AUTOSAR-compliant system model that integrates both timing and security constraint, an integrated mixed-integer linear programming formulation (i-MILP) for the optimal DSE of CAN FD, and a divide-and-conquer approach to the i-MILP (dc-MILP) to address its timing complexity problem. The experiment results show that dc-MILP scales well for industrial-size systems and saves 1.94%-4.76% bandwidth utilization and guarantees the schedulability for more signal sets by comparing with the state-of-the-art algorithm.

In recent decades, the research of energy-aware scheduling on heterogeneous multiprocessor systems is becoming more and more popular. A classic method for real-time task allocation is Linear Programming (LP). However, existing LP formulations are usually regarded as ineffective in solving large-scale allocation problems due to the unacceptable time consumption. In this work, we propose two integer linear programming (ILP) formulations to deal with the allocation problems for large task sets. One exact ILP(1) is formulated to derive an intermediate solution, and the other relaxed ILP(2) is considered to calculate the desired minimum energy. Then the desired minimum energy can be taken as a reference to evaluate the optimality of the intermediate solution. Experimental results on randomly generated task sets demonstrate that our method achieves average 19.2% less energy within limited time than the classic greedy and the state-of-the-art heuristic algorithm.

Nowadays, in-vehicle network design has become a difficult challenge due to increased complexity and strict real-time constraints. In this work, we propose an integrated framework for CAN network topology design under real-time constraints. The framework integrates topology design with real-time analysis. It firstly allocates electronic control units (ECU) automatically to one of the CAN buses via integer linear programming (ILP) optimization. Then, the worst case response rate (WCRR) results of real-time analysis are fed back to a weighted ILP optimization to further improve the topology design with respect to a realtime property. A case study using a real message set from automaker validated the effectiveness and scalability of the proposed framework.