skip to main content
OSTI.GOV title logo U.S. Department of Energy
Office of Scientific and Technical Information

Title: Towards a CAN IDS Based on a Neural Network Data Field Predictor

Abstract

Modern vehicles contain a few controller area networks (CANs), which allow scores of on-board electronic control units (ECUs) to communicate messages critical to vehicle functions and driver safety. CAN provides a lightweight and reliable broadcast protocol but is bereft of security features. As evidenced by many recent research works, CAN exploits are possible both remotely and with direct access, fueling a growing CAN intrusion detection system (IDS) body of research. A challenge for pioneering vehicle-agnostic IDSs is that passenger vehicles' CAN message encodings are proprietary, defined and held secret by original equipment manufacturers (OEMs). Targeting detection of next-generation attacks, in which messages are sent from the expected ECU at the expected time but with malicious content, researchers are now seeking to leverage "CAN data models'', which predict future CAN messages and use prediction error to identify anomalous, hopefully malicious CAN messages. Yet, current works model CAN signals post-translation, i.e., after applying OEM-donated or reverse-engineered translations from raw data. We present initial IDS results testing deep neural networks used to predict CAN data at the bit level, targeting IDS capabilities that avoiding reverse engineering proprietary encodings. Our results suggest the method is promising for data with signals exhibiting dependence on previousmore » or concurrent inputs.« less

Authors:
 [1]; ORCiD logo [2]; ORCiD logo [2]
  1. Pennsylvania State University
  2. ORNL
Publication Date:
Research Org.:
Oak Ridge National Lab. (ORNL), Oak Ridge, TN (United States)
Sponsoring Org.:
USDOE
OSTI Identifier:
1513385
DOE Contract Number:  
AC05-00OR22725
Resource Type:
Conference
Resource Relation:
Conference: ACM Workshop on Automotive Cybersecurity (AutoSec)in conjunction with ACM CODASPY 2019 - Dallas, Texas, United States of America - 3/27/2019 4:00:00 AM-
Country of Publication:
United States
Language:
English

Citation Formats

Pawelec, Krzysztof, Bridges, Robert A., and Combs, Frank L. Towards a CAN IDS Based on a Neural Network Data Field Predictor. United States: N. p., 2019. Web. doi:10.1145/3309171.3309180.
Pawelec, Krzysztof, Bridges, Robert A., & Combs, Frank L. Towards a CAN IDS Based on a Neural Network Data Field Predictor. United States. doi:10.1145/3309171.3309180.
Pawelec, Krzysztof, Bridges, Robert A., and Combs, Frank L. Fri . "Towards a CAN IDS Based on a Neural Network Data Field Predictor". United States. doi:10.1145/3309171.3309180. https://www.osti.gov/servlets/purl/1513385.
@article{osti_1513385,
title = {Towards a CAN IDS Based on a Neural Network Data Field Predictor},
author = {Pawelec, Krzysztof and Bridges, Robert A. and Combs, Frank L.},
abstractNote = {Modern vehicles contain a few controller area networks (CANs), which allow scores of on-board electronic control units (ECUs) to communicate messages critical to vehicle functions and driver safety. CAN provides a lightweight and reliable broadcast protocol but is bereft of security features. As evidenced by many recent research works, CAN exploits are possible both remotely and with direct access, fueling a growing CAN intrusion detection system (IDS) body of research. A challenge for pioneering vehicle-agnostic IDSs is that passenger vehicles' CAN message encodings are proprietary, defined and held secret by original equipment manufacturers (OEMs). Targeting detection of next-generation attacks, in which messages are sent from the expected ECU at the expected time but with malicious content, researchers are now seeking to leverage "CAN data models'', which predict future CAN messages and use prediction error to identify anomalous, hopefully malicious CAN messages. Yet, current works model CAN signals post-translation, i.e., after applying OEM-donated or reverse-engineered translations from raw data. We present initial IDS results testing deep neural networks used to predict CAN data at the bit level, targeting IDS capabilities that avoiding reverse engineering proprietary encodings. Our results suggest the method is promising for data with signals exhibiting dependence on previous or concurrent inputs.},
doi = {10.1145/3309171.3309180},
journal = {},
number = ,
volume = ,
place = {United States},
year = {2019},
month = {3}
}

Conference:
Other availability
Please see Document Availability for additional information on obtaining the full-text document. Library patrons may search WorldCat to identify libraries that hold this conference proceeding.

Save / Share: