Universally applicable signal-based controller area network (CAN) intrusion detection system
A system and method for intrusion detection on automotive controller area networks. The system and method can detect various CAN attacks, such as attacks that cause unintended acceleration, deactivation of vehicle's brakes, or steering the vehicle. The system and method detects changes in nuanced correlations of CAN timeseries signals and how they cluster together. The system reverse engineers CAN signals and detect masquerade attacks by analyzing timeseries extracted from raw CAN frames. Specifically, anomalies in the CAN data can be detected by computing timeseries clustering similarity using hierarchical clustering on the vehicle's CAN signals and comparing the clustering similarity across CAN captures with and without attacks.
1. An intrusion detection system for detecting masquerade attacks on CAN data communicated over a vehicle controller area network (CAN) of a vehicle, the intrusion detection system comprising: a CAN transceiver configured to receive CAN frames from the vehicle CAN, wherein each CAN frame includes an arbitration identifier (AID) and an up to 64-bit data payload; a CAN controller in communication with the CAN transceiver;
a processor in communication with the CAN controller, wherein the processor is configured to generate a signal definition for each AID mapping the up to 64-bit data payloads of CAN frames with that AID to a plurality of tokenized and translated signals defined by one or more sequences of bits of the up to 64-bit data payload, wherein the mapping accounts for start bit, length, endianness, and signedness of the signals; wherein the processor is configured to (1) learn inherent relationships between uninterpreted timeseries signals in decoded CAN training payload data without dependence upon CAN diagnostic inquiry; (2) learn inherent relationships between uninterpreted timeseries signals in decoded CAN test payload data without dependence upon CAN diagnostic inquiry; (3) detect masquerade attacks on CAN test payload data based on a contrast of the learned inherent relationships of timeseries signals in the decoded CAN training payload data and the learned inherent relationships of timeseries signals in the decoded CAN test payload data; and (4) upon detecting a masquerade attack on CAN test payload data, at least one of transmit an anomaly-notification message and log information relating to the detected masquerade attack.
2. The intrusion detection system of claim 1 wherein the processor is configured to store the signal definition for each AID together with the AID in a CAN database file (DBC) in memory.
3. The intrusion detection system of claim 1 , wherein the payload of the CAN frames from the vehicle CAN are encoded based on unknown signal definitions established by a third party, each signal definition including information to tokenize, translate, and interpret the CAN data, where the information to tokenize includes information to demarcate sequences of bits corresponding to signals in the CAN data and byte ordering, wherein the information to translate includes information about how the sequences of bits were converted to integers.
4. The intrusion detection system of claim 1 , wherein the processor is configured to monitor, during operation of the vehicle, the timeseries signals in the decoded CAN test payload data for anomalies to detect masquerade attacks in the CAN test payload data, wherein the processor is configured to: compute correlations between timeseries signals in the decoded CAN test payload data; and compute agglomerative hierarchical clusterings for the computed correlations between the timeseries signals for the CAN test payload data; compute similarity between hierarchical clusterings for the computed correlations between the timeseries signals for the CAN test payload data; generate a CAN test data distribution of similarities between hierarchical clusterings for the correlations between the timeseries signals for CAN test payload data; compare the CAN test data distribution of similarities between hierarchical clusterings for the correlations between the timeseries signals for the CAN test payload data and CAN training payload data distribution of similarities between hierarchical clusters based on the CAN training payload data stored in memory; and
identify one or more anomalies of the timeseries signals for the CAN test payload data based on the comparison of the CAN test payload data distribution of similarities and the CAN training payload data distribution of similarities.
5. The intrusion detection system of claim 4 wherein the processor is configured to compute the agglomerative hierarchical clusterings based on at least one of a single linkage function, complete linkage function, average linkage function, and a Ward's linkage function.
6. The intrusion detection system of claim 4 wherein the processor is configured to interpolate the timeseries signals in the decoded CAN test payload data according to a selected base-line frequency to an equivalent length.
7. The intrusion detection system of claim 4 , wherein at least one of the respective timeseries for each of the CAN test payload data signals includes a correlated attack, speedometer attack, engine coolant attack, reverse light on attack, and reverse light off attack.