CAN bus flood attack detection based on communication characteristics

Yimu JI; Zhipeng JIAO; Shangdong LIU; Fei WU; Jing SUN; Na WANG; Zhiyu CHEN; Qiang BI; Penghao TIAN

doi:10.11959/j.issn.2096-109x.2020005

您当前的位置：

首页 >

文章列表页 >

CAN bus flood attack detection based on communication characteristics

Papers | 更新时间：2024-06-03

- CAN bus flood attack detection based on communication characteristics
- Chinese Journal of Network and Information Security Vol. 6, Issue 1, Pages: 27-37(2020)
- 作者机构：
  
  1. 南京邮电大学计算机学院，江苏南京 210023
  2. 南京邮电大学江苏省无线传感网高技术研究重点实验室，江苏南京 210023
  3. 南京邮电大学高性能计算与大数据处理研究所，江苏南京 210023
  4. 南京邮电大学高性能计算与智能处理工程研究中心，江苏南京 210023；5.南京邮电大学自动化学院，江苏南京 210023
  5. 南京邮电大学自动化学院，江苏南京 210023
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2020005
  CLC： TP336
- Online First：2020-02，
  
  Published：15 February 2020
- 稿件说明：
移动端阅览
Yimu JI, Zhipeng JIAO, Shangdong LIU, et al. CAN bus flood attack detection based on communication characteristics[J]. Chinese Journal of Network and Information Security, 2020, 6(1): 27-37.
DOI：

Yimu JI, Zhipeng JIAO, Shangdong LIU, et al. CAN bus flood attack detection based on communication characteristics[J]. Chinese Journal of Network and Information Security, 2020, 6(1): 27-37. DOI： 10.11959/j.issn.2096-109x.2020005.

摘要

CAN由于其突出的可靠性和灵活性，已成为当代汽车应用最广泛的现场总线。但是标准CAN协议没有提供足够的安全措施，易遭受窃听、重放、泛洪、拒绝服务攻击。为了有效检测 CAN 总线是否遭受到攻击，并在遭受泛洪攻击时将恶意报文滤除。对车载 CAN 总线报文通信特征进行了分析，提出一种入侵检测方法，该方法可以有效进行入侵检测、恶意报文滤除。通过实验验证，该方法可以100%检测出CAN总线是否遭受攻击，恶意报文过滤的准确率可达99%以上。

Abstract

CAN has become the most extensive fieldbus for contemporary automotive applications due to its outstanding reliability and flexibility.However

the standard CAN protocol does not provide sufficient security measures and is vulnerable to eavesdropping

replay

flooding

and denial of service attacks.In order to effectively detect whether the CAN bus is attacked

and to filter malicious messages when subjected to flooding attacks.The characteristics of vehicle CAN bus message communication were analyzed

and an intrusion detection method was proposed

which could effectively perform intrusion detection and malicious message filtering.Through experimental verification

the method can detect whether the CAN bus is attacked by 100%

and the accuracy of malicious packet filtering can reach over 99%.

关键词

Keywords

references

WOLF M , WEIMERSKIRCH A , WOLLINGER T , et al . State of the art:embedding security in vehicles [J ] . EURASIP Journal on Embedded Systems , 2007 ( 5 ): 1 - 16 .

NOLTE T , HANSSON H , BELLO L L , et al . Automotive communications-past,current and future [C ] // IEEE International Conference on Emerging Technologies and Factory Automation . 2005 : 19 - 22 .

CHECKOWAY S , MCCOY D , KANTOR B , et al . Comprehensive experimental analyses of automotive attack surfaces [C ] // USENIX Security Symposium . 2011 .

AVATEFIPOUR O.MALIK H . State-of-the-art survey on in-vehicle network communication can-bus security and vulnerabilities [J ] . Comput Sci Netw , 2017 , 6 : 720 - 727 .

ANDREEA R , FLAVIO D . LeiA:A lightweight authentication protocol for CAN [C ] // Computer Science-ESORIC , 2016 : 283 - 300

YING X , BERNIERI G , CONTI M , et al . TACAN:transmitter authentication through covert channels in controller area networks [J ] .arXiv preprint arXiv.1903.05231,2019. arXiv preprint arXiv.1903.05231 , 2019 .

HOPPE T , KILTZ S , DITTMANN J , et al . Security threats to automotive can networks practical examples and selected short term countermeasures [J ] . Reliability Engineering and System Safety , 2011 ( 96 ): 11 - 25 .

TAYLOR A , JAPKOWICZ N , LEBLANC S , et al . Frequency-based anomaly detection for the automotive CAN bus [C ] // World Congress on Industrial Control Systems Security . 2015 : 45 - 49 .

SONG H M , KIM H R , KIM H K , et al . Intrusion detection system based on the analysis of time intervals of CAN messages for in-vehicle network [C ] // 2016 International Conference on Information Networking (ICOIN) . 2016 : 63 - 68 .

MUTER M , ASAJ N . Entropy-based anomaly detection for in-vehicle networks [J ] ..2011:1110-1115. IEEE Intelligent Vehicles Symposium , 2011 : 1110 - 1115 .

MUTER M , GROLL A , FRELING F , et al . A structured approach to anomaly detection for in-vehicle networks [C ] // International Conference on Information Assurance and Security . 2010 : 92 - 98 .

MOORE M R , BRIDGES R A , COMBS F L , et al . Modeling inter-signal arrival times for accurate detection of can bus signal injection attacks:a data-driven approach to in-vehicle intrusion detection [C ] // Annual Conference on Cyber and Information Security Research . 2017 :11.

MILLER C , VALASEK C . Adventures in automotive networks and control units [C ] // Def Con . 2013 : 260 - 264 .

MILLER C , VALASEK C . A survey of remote automotive attack surfaces [C ] // BlackHat USA , 2014 :94.

SAGONG S U , YING X , BUSHNELL L , et al . Exploring attack surfaces of voltage-based intrusion detection systems in controller area networks [C ] // ESCAR Europe 2018 . 2018 : 1 - 13 .

Views

658

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

FL-IoV: comprehensive intrusion detection method for internet of vehicles based on federated learning

Application research of sample data generation based on improved Cycle-GAN in intrusion detection

Research on intrusion detection model based on synchronization of heterogenous executer

Personalized lightweight distributed network intrusion detection system in fog computing

Method on intrusion detection for industrial internet based on light gradient boosting machine

Related Author

HUANG Kai

JIANG Libing

JIANG Yuchang

GUO Hangkai

ZENG Qingpeng

WEI Shuai

Yu Hong

ZHU Zhengbin

Related Institution

Beijing Unionpay Card Technology Co., Ltd., Shenzhen Branch

School of Mathematics and Computer Sciences, Nanchang University

Information Engineering University

Songshan Laboratory

College of Automation/ Institute of Industrial Internet, Chongqing University of Posts and Telecommunications

⁰