CAN bus protection systems and methods
CAN bus signal format inference includes: extracting candidate signals from training CAN bus message traffic; defining one or more signals, each signal being a candidate signal that matches structural characteristics of a matching data type and each signal being assigned the matching data type; and generating an inferred CAN bus protocol with which the defined one or more signals conform. Signals are extracted from CAN bus message traffic using the inferred CAN bus protocol, an anomaly in an extracted signal is detected, and an alert is generated indicating the detected anomaly. In another aspect, a transport protocol (TP) signal is extracted and analyzed to determine a fraction of the TP signal that matches opcodes of a machine language instruction set, and an anomaly is detected based at least in part on the determined fraction exceeding an opcode anomaly threshold.
1 . An electronic device comprising:
an electronic processor communicatively coupled with a Controller Area Network (CAN) bus; and
a non-transitory storage medium storing descriptor files representing a plurality of CAN bus protocols and instructions readable and executable by the electronic processor to perform a CAN bus security method including:
extracting signals from CAN bus message traffic on the CAN bus wherein each extracted signal conforms with one of the plurality of CAN bus protocols;
detecting an anomaly in an extracted signal of the extracted signals if a component of the extracted signal exceeds a predetermined threshold of a set of instruction data and the extracted signal is not identified as an authorized update for the electronic device; and
generating an alert indicating the detected anomaly.
2 . The electronic device of claim 1 , wherein:
the extracting is performed over an initial time interval; and
the detecting comprises detecting a deviation of one of the extracted signals from the conforming with one of the plurality of CAN bus protocols over a later time interval subsequent to the initial time interval.
3 . The electronic device of claim 1 , wherein the descriptor files are DBC files.
4 . An electronic device comprising:
an electronic processor communicatively coupled with a Controller Area Network (CAN) bus; and
a non-transitory storage medium storing (i) one or more machine language instruction sets wherein each machine language instruction set comprises a set of opcodes and (ii) instructions readable and executable by the electronic processor to perform a CAN bus security method including:
extracting a signal comprising data bytes of a plurality of messages from CAN bus message traffic on the CAN bus;
for each machine language instruction set of the one or more machine language instruction sets, determining a fraction of the signal that matches opcodes of the machine language instruction set; and
detecting an anomaly based at least in part on at least one of the determined fractions exceeding an opcode anomaly threshold, wherein the detecting includes one of:
performing byte rotation on bytes of the signal before matching the signal with the opcodes of the machine language instruction set; or
detecting an anomaly if (I) at least one of the determined fractions exceeds the opcode anomaly threshold and (II) the signal is not identified as an authorized firmware update.
5 . A non-transitory storage medium storing instructions readable and executable by at least one electronic processor to perform:
receiving an inferred CAN bus protocol generated offline by a CAN bus signal format inference method comprising:
extracting candidate signals from training CAN bus message traffic wherein each candidate signal is a time sequence of repetitions of an ordered group of data bits in the CAN bus message traffic wherein the ordered group of data bits is delineated by one or more message headers;
defining one or more signals wherein each signal is a candidate signal that matches structural characteristics of a matching data type and each signal is assigned the matching data type; and
generating the inferred CAN bus protocol with which the defined one or more signals conform; and
a CAN bus security method including:
extracting signals from CAN bus message traffic on a CAN bus wherein each extracted signal conforms with the inferred CAN bus protocol;
detecting an anomaly in an extracted signal; and
generating an alert indicating the detected anomaly.
6 . The non-transitory storage medium of claim 5 , wherein the defining of one or more signals includes:
defining the signal assigned with a counter data type as the candidate signal that matches a structural characteristic of the counter data type in which values of the ordered group of data bits defined by the counter data type monotonically increase or monotonically decrease over the time sequence of repetitions of the ordered group of data bits.
7 . The non-transitory storage medium of claim 5 , wherein the defining of one or more signals includes:
defining the signal assigned with a constant data type as the candidate signal that matches a structural characteristic of the constant data type in which values of the ordered group of data bits are constant over the time sequence of repetitions of the ordered group of data bits.
8 . The non-transitory storage medium of claim 5 , wherein the defining of one or more signals includes:
defining the signal assigned a bit-field data type as the candidate signal that matches a structural characteristic of the bit-field data type in which values of the ordered group of data bits are indicative of a binary state.