9 - read paper and provide feedback/review

Short Paper—Paper Formatting for online-journals.org

Automotive Hacking, Cyberattacks on the CAN Bus and

Countermeasures

Abstract—During the last decade, different companies are thriving on re-

search and development for creating full self-driving cars. To reach this state,

the parts inside of a vehicle are communicating with each other harder than ever

before and more securely than ever before. Therefore, the CAN Bus, which con-

nects all inner electronic components inside of a car, has been developing at a

rapid pace. During this development, one of the key aspects has been and will al-

ways be security. CAN is a protocol that had no security mechanisms built in

when it was invented. But as the components in the inner network of vehicles

started to exchange more and more sensitive data, and furthermore, this network

even started to communicate with outside networks, the CAN Bus was seriously

threated by cyberattacks. In this paper we analyze many vulnerabilities of the

CAN Bus and what countermeasures have been implemented to tackle every

vulnerability, together with their advantages and their disadvantages. We will

make a short recap for what is the CAN Bus, and which are the internal com-

ponents that connect to it. Then, we will see some of the attacks that can be

performed on the CAN Bus and then how some of the countermeasures, e.g.,

cryptography, intrusion detection systems deal with the attacks and their limita-

tions.

Keywords— CAN, Bus, ECU, Cyberattacks, Cryptography, Intrusion Detec- tion Systems, Sensors, Security.

1 Introduction

Not too long ago, all vehicles were not technology-based. They used to complete

most of their tasks in manual ways. Nowadays, as technology continues to evolve, most

of the car companies have found ways to automate most of the processes inside and out-

side of a car. In the last few years, automobiles have been connecting more and more to

other automobiles and to the infrastructure [1]. Talking about connectivity in modern au-

tomobiles makes us think of a possibility where we can even use our smartphones to con-

trol our vehicles. Even more, self- driving and autonomous vehicles are now a real

thing. The global transport sector sees self-driving vehicles as its next comprehensive

technological development. Full self-driving vehicles are expected to bring a huge im-

provement in reducing accidents, increasing transportation quality, reducing conges-

tion, therefore lowering transportation time overall. By making all these possible, even

Short Paper—Paper Formatting for online-journals.org

some negative effects on pollution will be resolved, because these cars will maneuver

themselves more efficiently than humans can [2]. More importantly, they are ex-

pected to radically improve transportation safety. Yet again, these automobiles are

called Connected Autonomous Vehicles (CAVs), so we see the word "Connected" again.

Besides all the good things this connection has brought, it also exposes the risk of

cyberattacks. As the number of these attacks has grown, more and more penetration

points and vulnerabilities have been brought to light. This calls for improvements in

security techniques. Finding these improvements can be limited however, because the

CAN protocol where the electronic components use to communicate with each other is

not built with security in mind. The attacks that utilize the vulnerabilities of the CAN

protocol are used for inner and outer network attacks even for normal cars that are

partially automated. What about cars that capable for full self-driving? What defines a

self-driving car is its ability to maneuver itself without human interaction, so to make

this thing possible it requires many sensors, such as cameras, antennas, radars, LiDARs.

The readings from these sensors are a critical dependency for full self-driving automo-

biles to make all the judgements while moving. The credibility and reliability of these

sensor readings can take a shot when the system that controls these sensors is attacked

by viruses, or simple programming errors that haven't been tested well enough before

going to production. This is the reason why these vehicles use modern techniques to

encrypt the communication channels to improve their reliability and validity. The cam-

eras, Lidars and Radars fitted to these cars can see hindrances on the road ahead, so they

can maneuver past them effectively and without endangering the people inside and out-

side of the car. This means that they have critical tasks, so when a hostile attack happens

and affects the readings of a sensor, the car cannot understand well what is ahead and

accidents can happen. The cyberattacks on autonomous vehicles give the hackers the

opportunity to manipulate and control the data that is being communicated in the network

[2]. This is one of the main reasons why people are still sceptic on self-driving cars and

mostly why we are still not seeing them on the road. The companies that are trying to

build them are still researching on protection measures before going to production with

them

2 Vehicle Networks

2.1 Electronic Control Unit

Subsystems in an automobile are controlled electronically by implanted systems

called ECUs. [51]. Modern vehicles have 70-100 different ECUs to control all the

operations inside these vehicles such as gear selection, braking, power delivery from

the engine [1, 7]. These components transmit data with each other via several in-vehi-

cle networks. The three most important protocols in charge of the communications of the inner components of a vehicle are: FlexRay, LIN (Local InterConnect Network),

and most importantly CAN (Figure 1)

Short Paper—Paper Formatting for online-journals.org

Fig. 1. CAN, FlexRay and LIN protocols from Reference [3]

The most important components like the power train and transmission are sup-

ported by the CAN Bus Protocol. This protocol uses error detection and correction

techniques to make sure the critical operations are executed correctly. The LIN proto-

col supports operations that require low bandwidth and asynchronous communication

between different components of a car that are not critical, for example air condi-

tioning [4]. FlexRay on the other hand is a protocol that supports operations that re-

quire high bandwidth and error correction techniques [1]

2.2 Controller Area Network

Initially, all ECUs were wired to each component that they need to communicate

with in an independent manner, which meant the cost of cable used was enormous. This

large amount of cable needed made the cars heavier and more difficult to maintain. To

address this problem, CAN was invented. CAN is a convention developed by a German

company named Bosch nearly 40 years ago to make the communication possible be-

tween sensors and ECUs [6]. It is a serial bus that utilizes the multi-master topology to

allow ECUs to exchange data with each other. ECUs communicate using "CAN

frames". These CAN frames do not contain any data about who is sending and who is

receiving, and every ECU can push and pull frames from the bus when the CAN bus is

in an idle state [8]. Using CAN, vehicle manufacturers significantly lowered the cost of

connecting electronic components of their cars. Since the vehicles were not communicating with outer networks initially, the CAN

Bus was not built having security as a priority [10]. ECUs connected with the CAN Bus are essentially microcomputers that contain a CAN transceiver and a CAN Controller. The CAN transceiver establishes the connection between the ECU and the CAN bus, whereas the Controller reads and writes bytes of data on the bus. For data communica- tion, a broadcast-based system is utilized by the protocol, where each ECU can use the bus randomly [11]. But as we saw before, some ECUs have more critical duties than other ones, so an arbitration mechanism is used so that the nodes with higher priority take the control of the bus before nodes with lower priority. This mechanism compares the id of the requesting nodes that are trying to access the bus simultaneously. The per- mission to utilize the bus is given to the more important node [12]. The CAN Bus connects to a gateway ECU [13]. But the modern vehicles have different kinds of com- munication interfaces with outer networks, like mobile networks, Bluetooth, or Wi-Fi.

Short Paper—Paper Formatting for online-journals.org

This way, any ECU in the bus network could inject or sniff data from the bus using Bluetooth or OBD-2 ports. These security vulnerabilities have motivated manufacturers to integrate cryptography methods to offer integrity and authentication. Another way to stop unauthorized access is by building firewalls.

2.3 Vulnerability of CAN Bus

Some of the vulnerabilities that the CAN Bus suffers from:

Because the CAN Bus uses a broadcast system to provide the communication between

the nodes, all these nodes can theoretically read the exact frames that they previously

sent.

The data transmitted through the bus is effortlessly readable using sniffing attacks

because the data stream there is not encrypted. The bus connects all ECUs in a broad-

cast-based network, which makes each ECU able to sniff messages [50].

An ECU that has a high priority can block other ECUs from communicating with

the bus, thus creating a Denial of Service (DoS) attack.

The bus lacks security measures for authentication, which leads to opportunities for

DoS and message poisoning attacks on the CAN Bus to be successful.

Having external interfaces like Bluetooth, Wi-Fi and OBD-2 increases the vulnerability

of the CAN Bus from cyberattacks. [14].

2.4 Attacks against the CAN Bus

CAN Bus Denial of Service attacks: As we talked in the previous paragraphs, CAN

uses an arbitration mechanism to make sure that the components with higher priority fin-

ish their tasks first. The priority of a sent frame could be distinguished by the ECUs by

observing the "arbitration" part of the message. This way, the bus will be used only by

the most crucial node. While the bus is occupied, no other ECU can utilize the bus. This

way, a DoS attack can happen when a node sends many frames that have crucial prior-

ity. Consequently, the bus could not be used by any other ECU [3].

ECU Mocking: If a hacker manages to penetrate the CAN bus network, he can have a

look at all the data that is being transmitted in the bus. By analyzing this data, attackers

can see how every ECU behaves, so they can reverse engineer them. Attackers can even

disable an ECU, for example a publication has shown that attackers can exploit the ex-

ception managing implementation of the CAN protocol [17]. After reverse engineering

the specific ECU, attackers can send messages with the correct frequency and CAN

id. Then, a superior bit than what the attacked node is currently sending, is sent by the

mocked ECU. This leads to an error that disconnects the ECU from the CAN Bus.

CAN Bus fuzzing attack: Since authentication is absent in CAN protocol, ECUs accept

CAN frames and answers them. The CAN Bus fuzzing attack sends random CAN mes-

sages and notices what changes happen in the instrument board inside the car, for ex-

ample, what happens to the vehicle speed during the injection of CAN frames [16]. The

hackers send the frames, and they record the output. To mitigate this, the data should

be encrypted to stop the hackers from analyzing this output.

Short Paper—Paper Formatting for online-journals.org

CAN Bus sniffing: CAN Bus's data can be sniffed by an ECU, because the protective

measures, such as encryption and authentication mechanisms are absent in the CAN

protocol. By operating OBD2 sniffers, it is possible to fetch the data that is being trans-

mitted in the CAN Bus. After getting the data stream, attackers try to replicate the CAN

messages so they can send these newly created messages to attack specific parts of a ve-

hicle [15].

2.5 CAN Bus security implementations

Since the CAN Bus has limited resources, all security implementations that tackle its

vulnerabilities should take in consideration these limited resources. There are different

types of implementations. Cryptography-based implementations try to protect the bus

from hostile messages. Intrusion Detection-based implementations try to catch sight of

these hostile messages. These systems can be used to block unauthorized access from

outside of the car.

Cryptography: It is used to provide authentication and data secrecy. To implement cryp-

tography on the CAN Bus we need more computational resources on the CAN control-

lers. Since the computational power of these devices is very limited, lightweight en-

cryption is the only solution for these systems. The dare for this mechanism is that it

should not increase the payload size and the time latency, where the last one could harm

the safety of the vehicle. The mechanism here involves appending a MAC tag that is

smaller than 8 bytes to the actual payload. By adding this tag, we make sure that authen-

tication and data integrity are fulfilled, because the tag is encrypted using a secret key.

One other possibility is to extend the payload to 16 bytes by making the data field in

the protocol bigger so the MAC Signature can have more space. This mechanism how-

ever has compatibility problems to older systems. CAN Frame Authentication: The MAC tag that we talked above is a mechanism that

provides authentication and data integrity for in-vehicle networks. This system however does not achieve confidentiality, which means that the data transmitted through the CAN Bus is still vulnerable to reverse engineering attacks. To offer better security, a mixture of frame authentication and encryption is wanted. The mechanisms below offer these security feats, but they alter the initial behavior of the convention by extending the CAN frames and raising the response time, which is not totally compatible with present- day automobiles and leads to a higher price to implement:

In Citation [18], the creators worked on a mechanism to enforce access control and minimize distributing keys using a cryptographic function. The mechanism utilizes shared and group symmetric keys and the function of HMAC to distribute the keys. 1 byte is used for the payload, whereas for key channeling and the HMAC flag 15 bytes are used. They intercepted frame injection attacks with only 50 μs extra needed to process these messages. ECUs that were trusted were grouped to- gether and they shared a secret symmetric key. Since the OBD-2 ports and telematics represent the front door used by hackers, this mechanism works, because it detaches these two altogether. The problem is that this mechanism sends authentication data for every actual data sent, which doubles the load in the bus and makes the CPU work 2000 clock cycles faster [19]. Keeping the bus's limitations in mind, the authors used a lightweight encryption implementation, but the Denial-of-Service hacks were not ex-

Short Paper—Paper Formatting for online-journals.org

plored. Also, all actions were done on a CAN+ protocol with 16 bits which is not com- patible with standard CAN Bus. LCAP in Reference [20] provides a 2-byte magic number using a one-way hashing function. 2 bytes out of 8 bytes in the data field are used for this magic number in the standard CAN and 16 bytes out of 29 bytes in the extended CAN. This mechanism offers data integrity and authentication using symmetric keys and a magic number. This means that the system will be protected from reverse engineering attacks because of the ever-changing nature of the session keys and the magic number. The problem here stands on the fact the CAN transceiver should be modified to be able to understand the 16 bytes of the magic number in the payload. The authors in Reference [21] combine session keys with HMAC and SHA3 function together to protect the system from re-play hacks. This mechanism inserts a crypto- graphic checksum on each frame. The authors however did not publish details on re- sponse time. CaCAN [22] is a mechanism that uses a centralized ECU, which distributes keys among each node. As we know, CAN Bus has a broadcasting behavior, thus, the main ECU reads all messages and overwrites all unauthorized messages. This implementation pro- vides integrity of the CAN messages, but it needs extra hardware for the main ECU and does not provide confidentiality. In Reference [23], to provide data integrity and authentication, the publishers used a combination of HMAC and SHA256 functions. Together with the actual payload they sent a 1-byte MAC tag and a 4- bit counter to stop reverse engineering attacks. This mechanism also includes a centralized ECU that reads all messages thanks to the broadcast behavior of the CAN Bus and checks if they hold every key. If they do, they are valid. If the centralized ECU detects a message that doesn't hold every key, it sends a signal to reset the hostile message. All the techniques that we mentioned in the previous paragraph deliver data integrity as well as authentication, but these techniques are not bulletproof. Delays, additional costs, and backward compatibility are the most obvious ones.

2.6 CAN frame encryption

The creators of Citation [24], managed to provide authenticity, data confidentiality and integrity by combining encryption and authentication mechanisms. Sniffing and injection attacks were detected and prevented using this mechanism. The caveat is that it sends multiple frames for a single CAN ID message, which increases bus load and latency. In Reference [25], the authors managed to come up with a system that provides encryption and authentication using a hardware-based approach. A centralized ECU (the ECU Server) managed all ECUs connected to the CAN Bus. This main ECU au- thenticated all ECUs of the CAN Bus and distributed keys. This mechanism takes for granted the fact that keys are registered for each ECU during production. This lowers the computational overhead, but it is not compatible in current vehicles and can only be achieved by modifying current vehicles or applying this mechanism in new vehicles. In Reference [26], the author Farag came up with the CANTrack algorithm. Utilizing a dynamic secret key, this algorithm manages to encipher the real data (8 bytes). Also, this keeps the message ID unmodified, because it is utilized in the priority- deciding mech- anism. Testing of this approach has shown that it is able to prevent reverse engineering, sniffing and spoofing attacks.

Short Paper—Paper Formatting for online-journals.org

In Reference [27], an architecture that supports encryption, authentication and key management for a CAN Bus is introduced. For the purpose of guaranteeing the admin- istration of keys, the authors there utilized AKEP2 ("Authentication Key Exchange Pro- tocol 2") and symmetric key. 16 bytes are used by tags that combine HMAC and SHA256 functions. The rest (47 bytes) is encrypted by AES-128 function

2.7 IDS for In-Vehicle Networks

Intrusion Detection Systems are split into two key groups depending on their location:

Network-IDS (NIDS) and Host- IDS (HIDS) [29]. HIDS are not really a viable option

for current automobile networks, because it is not compatible with current ECUs [30].

Plugging in a NIDS as an additional node however is much more reasonable as it is

compatible with current CAN Bus specifications and does not require additional

changes [31]. An IDS can report potential attacks or can even execute countermeasures

to stop the attacks. To stop the CAN Bus from being completely idle for certain inter-

vals, the ECUs generate CAN frames after a certain amount of time [32]. Therefore,

many IDS mechanisms are developed based on the constant behavior of the CAN traffic.

Another mechanism compares the voltage and signal generated by each CPU to

find any anomalies. According to Reference [33], these are some sensors that these

systems utilize to spot cyberattacks on the CAN network:

Payload range detector: Makes sure the values in the payload are admissible.

Location sensor: Makes sure a specific message has been sent by the correct CAN com-

ponent. Frequency sensor: Checks the time when a CAN message has been sent.

Format sensor: Disassembles a CAN frame and makes sure all its fields have the cor-

rect size as well as if the check sum is correct.

Correlation sensor: Validates multiple messages exchanged between different compo-

nents in the CAN Bus.

Protocol sensor: Observes the traffic in the CAN Bus and spots any deviations from

the protocol specification.

Gateway sensor: Connects various components within the network of an automobile.

Consistency sensor: Observes the payload field of CAN frames for any inconsistency.

Plausibility sensor: Makes sure that the values of the payload field are in the predeter-

mined range.

When the IDS observes a CAN frame for potential security risks, it scans these fields: CAN identifier: This is the field that establishes the message's priority on the bus. When

the IDS sees an identifier with the highest possible priority, it considers this message

capable to initiate a DoS attack on the bus.

Data Length Code: A field of 4 bytes that determines the size for the payload. It uses static

range and value, so every node has a limited length in its frames' payload.

Timestamp: Every CAN frame holds a timestamp, so that an IDS can observe when ir-

regular activities have happened.

Data field: The length of this part of the frame should not surpass 8 bytes. Irregularities

can occur when the data field does not respect this limit.

Short Paper—Paper Formatting for online-journals.org

2.8 Types of IDS mechanisms used for in-vehicle networks

Signature-based IDS: Some attacks have known ways of how they work, so these ways

are listed as pre-determined collection of attack signatures. Every time a not pre- deter-

mined attack occurs, the IDS adds this new attack's signature in its list [34]. As

time goes on, this collection will grow bigger and a real time fetch for the signature of a

specific attack in such a big collection is a challenge. In Citation [35],

the list of signatures were filled by a subset of a CAN dataset. The creators of this

citation developed a signature-based IDS where they used this list. This approach how-

ever has limitations because the CAN words' length is not known

beforehand. In Reference [36], an anti-spoofing system was developed by the authors.

It would detect hostile messages by detecting CAN message ID from all ECUs that didn't

send that message. The CAN Bus overwrites the spoofed message when the ECU informs the IDS about the spoofed message.

Anomaly Detection-Based IDS: These types of Intrusion Detection Systems identify

irregular traffic, new attack patterns, and anticipate attacks that were not seen before via

a learning model using machine-learning, statistical, and rule- based methods:

Statistical mechanisms: The IDS learns the regular behavior of the system using statis-

tical analysis. A threshold is set by using a reference known pattern. Statistical analysis

in CAN Bus networks use the frequency of the messages sent and the consistency of the

payloads. This is because CAN frames are sent in fixed intervals by the ECUs [37] and

the payloads often have consistent values. This IDS can sense inconsistent frames and

modified payload values. In Reference [38] these are some of the statistical mechanisms

used: (i) how many packets are transmitted in the time between CAN frames; (ii) CAN ID Frequency (How many times a certain CAN ID has been transmitted over a certain

amount of time); (iii) response time from a request to a reply.

Statistical techniques, e.g., Anova, Heretical Temporal Memory, Entropy, etc. Let's see

these approaches in detail below:

CAN ID Frequency: In References [39, 40], the respective authors want to detect

message injection and DoS attacks by measuring irregularities in traffic frequency. This

approach however is not practical for mocked ECU, payload manipulation, and small-

volume attacks.

Intervals Between CAN Frames: In Reference [41], the authors have developed an ap-

proach where all ECUs are marked by a clock-based IDS based on the intervals when

they exchange messages. This mechanism uses the "Cumulative Sum" algorithm to point

out any irregularities. This algorithm uses a sequential analysis mechanism and a least square cost function. However, in this mechanism it is also a challenge to diagnose

mocked ECUs and small- volume injected messages.

Payload behavior and Entropy of CAN ID: The creators of Reference [42] have esti-

mated the entropy that corresponds along the differences in the transmission inside the

CAN Bus compared to the normal CAN traffic. This mechanism was tested versus mes-

sage injection cyberattacks, but the authors discovered that this mechanism could not

spot little injected CAN messages. In Reference [43], as the reference line for the IDS that

they introduced, they utilized a mechanism using a static integer of messages over a

“sliding window”. Entropy calculations using the optimal size of the sliding window

with a static amount of CAN frames enhanced the precision of the IDS, even better than

previous examples.

Short Paper—Paper Formatting for online-journals.org

Hamming Distance: In Reference [44], the authors developed an approach by record-

ing the payload together with every bit. The approach measured the Hamming distance

for each message id to each payload. Cyberattacks corresponded to a larger deviation

from the calculated Hamming distance function.

Defined Time Window: In Citation [12] the average number of frame IDs broadcasted

during an interval was measured. To test their approach, the authors utilized ARIMA

and Z-Score to make these calculations. This mechanism detected CAN injections suc- cessfully and was able to drop packet attacks.

2.9 Approaches using Machine Learning

IDSs established on ML are a great way for differentiating regular and irregular activ-

ities in a system. They continuously learn the characteristics of regular and irregular

behavior and then they provide a model that detect and intercept attacks. Hidden Markov Models: In Reference [45], the authors use an approach that works

time-series data to spot irregular characteristics in the behavior of the system. They use

an IDS, roots of which come from Markov Chains [46] to develop a prototype that

raises alarms when abnormal behavior was detected. They assessed their approach

using instant monitoring against immediate changes in some variable values by

injecting hostile messages.

Deep Learning and Neural Networks: To irregularities as deviation from

normal behavior, the authors of Reference [47] utilized deep neural networks for learn-

ing regular behaviors by working on autonomous raw data. For pre-process the dataset,

they used an autonomous deep network for identifying normal behaviors of the system.

To make their results even more realistic, they added noise to their dataset so they could mimic the real world. They generated CAN frames using this mechanism. This mecha-

nism improves the safety from DoS and Spoofing attacks.

Decision Trees: Decision tree-based Intrusion Detection Systems separate the

CAN data into two classes, normal and abnormal. To make their decisions, these sys-

tems require a tagged collection of data through their training phase. For the purpose of

making a better classifier, authors of Reference [48] have used a technique by combin-

ing entropy together with regression Decision Tree and Gradient Boosting (GBDT).

They used 750,000 real captured CAN messages to validate this approach.

2.10 Discussion on different IDS

IDSs for In-Vehicle Networks are used to catch sight of hostile CAN attacks. Signature-

based IDS advantage is that they have a low false positive rate, but the signature of an

attack should be known previously and should be extracted from the CAN Bus, so it is

hard to detect new CAN attacks.

Anomaly-based IDS advantage over Signature-based IDS is that they can train and learn

the behaviors of different type of attacks so they can be ready if a new one gets injected

to the system.

Intrusion Detection Systems, foundations of which are on machine learning, make the

most from the raw data extracted by the automobiles. They can also process with ease

large amounts of data.

Short Paper—Paper Formatting for online-journals.org

3 Limitation of current mechanisms to CAN network security

3.1 Cryptography

Hardware-based cryptography: This implementation makes the process of crypto-

graphic mechanisms faster and close to real-time, but they suffer from incompatibility

issues and have a big cost of implementation, because most of the current ECUs must

be replaced.

Software-based cryptography: This approach needs less resources to execute and can

be applied to existing ECUs. The main problem of software-based cryptography is that

they need relatively powerful ECUs to complete their tasks. To tackle this problem, some

of the functions can be executed only in a small subset of ECUs that have sufficient re-

sources [49].

3.2 Intrusion Detection System

Since different vehicles are manufactured differently, each have their own properties

and vulnerabilities. This means that there cannot be a global database that contains the

signatures of all possible attacks. One way is for every manufacturer to develop a sim-

ilar database for the vehicles that they produce and to maintain it as time passes by.

ML-based IDSs can have high-end specification demands, whereas many current ECUs

don't have sufficient resources.

IDS can be integrated in the system by being installed on every ECU [30], but this ap-

proach is very costly and probably not very compatible. Incorporating an IDS as a new

network node on the other hand can be very practical and low cost. By installing an

OBD-2 dongle, we don't need modifications to the CAN network [31].

4 Conclusions

Since the time when all the electronic components were connected into a network,

the problems of cybersecurity in automobiles have risen. As time passes, attackers find

new ways to exploit the vulnerabilities in the CAN network and people working to

make the cars more secure come with solutions to defend these cars from various

attacks.

One solution is cryptography. These mechanisms try to secure the CAN network from

internal or external cyberattacks. Anyway, most of the time, the nodes in the network

don't have the sufficient resources to complete their tasks in real-time. That is why IDSs

operate passively in vehicles. They are way more compatible with current systems that

what cryptographic approaches offer. Some IDSs however that are ML-based need very

high-end computational abilities. To satisfy the compatibility with current CAN Buses,

peripheral ECU devices, like OBD-2 can be utilized to observe and supervise encryp-

tion and authentication mechanisms. To overcome the limitations of current CAN

buses, manufacturers are expected to release to production CAN FD by 2022 [52]. It

Short Paper—Paper Formatting for online-journals.org

will bring way better resources, like support for computing-intensive encryption mech-

anisms, bigger payload size, better bandwidth. The entry points to the internal network

of a vehicle should be secured. These entry points can be the sensors' interfaces, info-

tainment, or telematics. During the last years, manufacturers have been trying to en-

hance the performance and security for In-Vehicle networks, since we are seeing rapid

development of autonomous vehicles and for this, performance and security are key.

5 References

[1] Emad Aliwa, Omer Rana, Charith Perera, and Peter Burnap. 2021. Cyberattacks

and Countermeasures for In- Vehicle Networks. ACM Comput. Surv. 54, 1, Article 21

(April 2021), 37 pages. DOI:https://doi.org/10.1145/3431233

[2] A. Chowdhury, G. Karmakar, J. Kamruzzaman, A.Jolfaei and R. Das, "Attacks on Self-Driving Cars and Their Countermeasures: A Survey," in IEEE Access, vol.8, pp. 207308-207342, 2020, doi: 10.1109/ACCESS.2020.3037705 [3] Huang T., Zhou J., Wang Y., Cheng A. (2017) On the Security of In-Vehicle Hybrid

Network: Status and Challenges. In: Liu J., Samarati P. (eds) Information Security Prac-

tice and Experience. ISPEC 2017. Lecture Notes in Computer Science, vol 10701.

Springer, Cham. https://doi.org/10.1007/978-3-31972359-4_38

[4] ISO. 2016. ISO 17987: Road Vehicles—Local Interconnect Network (LIN) Part 1: General Information and Use Case Definition. Technical Report. Retrieved August

2020 from https://www.iso.org/standard/61222.html

[5] International Organization for Standardization. 2015. ISO 11898-1:2015–Road Ve-

hicles–Controller Area Network (CAN)–Part 1: Data Link Layer and Physical Signal-

ling.Retrieved August 2020 from https://www.iso.org/standard/ 63648.html.

[6] Omid Avatefipour and Hafiz Malik. 2018. State-of-the-art survey on in-vehicle net-

work communication (CANBus) security and vulnerabilities. arxiv:1802.01725.

Retrieved from https://arxiv.org/abs/1802.01725. [7] Olufowobi, H., Hounsinou, S., & Bloom, G. (2019). Controller Area Network In-

trusion Prevention System Leveraging Fault Recovery. Proceedings of the ACM Work-

shop on Cyber-Physical Systems Security & Privacy - CPS-SPC’19.

doi:10.1145/3338499.3357360

[8] Zhou, Jia & Joshi, Prachi & Zeng, Haibo & Li, Renfa. (2019). BTMonitor: Bit-time-

based Intrusion Detection and Attacker Identification in Controller Area Network.

ACM Transactions on Embedded Computing Systems. 18. 1-23. 10.1145/3362034

[9] Microchip. 2003. Mcp2515 notes. 94. Retrieved August 2020 from http://ww1.mi-

crochip.com/downloads/en/ DeviceDoc/MCP2515-Stand-Alone-CAN-Controllerwith-

SPI-20001801J.pdf [10] Marco Di Natale, Haibo Zeng, Paolo Giusto, and Arkadeb Ghosal. 2012. Under-

standing and Using the Controller Area Network Communication Protocol: Theory and

Practice. Springer Science & Business Media.

[11] Brown, R., Marti, A., Jenkins, C., & Shannigrahi, S. (2020). Dynamic Address

Validation Array (DAVA). Proceedings of the 7th ACM Workshop on Moving Target

Defense. doi:10.1145/3411496.3421221

[12] Tomlinson, Andrew & Bryans, Jeremy & Shaikh, Siraj & Kalutarage, Harsha.

(2018). Detection of Automotive CAN Cyber-Attacks by Identifying Packet Timing

Short Paper—Paper Formatting for online-journals.org

Anomalies in Time Windows. 231-238. 10.1109/DSNW.2018.00069. [13] Juan Deng, Lu Yu, Yu Fu, Oluwakemi Hambolu, and Richard R. Brooks. 2017.

Security and Data Privacy of Modern Automobiles. 131–163

[14] W. Wu et al., "A Survey of Intrusion Detection for In-Vehicle Networks," in IEEE

Transactions on Intelligent Transportation Systems, vol. 21, no. 3, pp. 919-933,

March 2020, doi: 10.1109/TITS.2019.2908074.

[15] Kang, T. U., Song, H. M., Jeong, S., & Kim, H. K. (2018). Automated Reverse

Engineering and Attack for CAN Using OBD-II. In 2018 IEEE 88th Vehicular Technology Conference, VTC-Fall 2018 -Proceedings [8690781] (IEEE Vehicular

Technology Conference; Vol. 2018-August). Institute of Electrical and Electronics En-

gineers Inc.. https://doi.org/10.1109/VTCFall.2018.8690781

[16] J. Khan, "Vehicle network security testing," 2017 Third International Conference

on Sensing, Signal Processing and Security (ICSSS), 2017, pp. 119-123, doi:

10.1109/SSPS.2017.8071577.

[17] K. Iehira, H. Inoue and K. Ishida, "Spoofing attack using bus-off attacks against a specific ECU of the CAN bus," 2018 15th IEEE Annual Consumer Communications &

Networking Conference (CCNC), 2018, pp. 1-4, doi:

10.1109/CCNC.2018.8319180.

[18] Wang, Qiyan & Sawhney, Sanjay. (2015). VeCure: A practical security framework

to protect the CAN bus of vehicles. 2014 International Conference on the Internet of

Things, IOT 2014. 13-18.10.1109/IOT.2014.7030108.

[19] O. Avatefipour, A. Hafeez, M. Tayyab and H. Malik, "Linking received packet to the transmitter through physical-fingerprinting of controller area network," 2017 IEEE

Workshop on Information Forensics and Security (WIFS), 2017, pp. 1-6, doi:

10.1109/WIFS.2017.8267643

[20] Hazem, A., & Fahmy, H. (2012). LCAP-A Lightweight CAN Authentication Pro-

tocol for Securing In-Vehicle Networks

[21] Sebastian Bittl. 2014. Attack potential and efficient security enhancement of auto- motive bus networks using short MACs with rapid key change. In Lecture Notes in

Computer Science (Including Subseries Lecture Notes in Artificial Intelligence and

Lecture Notes in Bioinformatics), Vol. 8435, 113–125

[22] Kurachi, Ryo & Matsubara, Yutaka & Takada, Hiroaki & Adachi, Naoki &

Miyashita, Yukihiro & Horihata, Satoshi. (2014). CaCAN - Centralized Authentication

System in CAN

[23] Ueda, H. & Kurachi, Ryo & Takada, Hiroaki & Mizutani, T. & Inoue, M. & Hori-

hata, S.. (2015). Security authentication system for in-vehicle network. 59.

[24] Ueda Dariz, M. Selvatici, M. Ruggeri, G. Costantino and F. Martinelli, "Trade-off

analysis of safety and security in CAN bus communication," 2017 5th IEEE

International Conference on Models and Technologies for Intelligent Transportation

Systems (MT-ITS), 2017, pp. 226-231, doi: 10.1109/MTITS.2017.8005670. [25] A. S. Siddiqui, Y. Gui, J. Plusquellic and F. Saqib, "Secure communication over

CANBus," 2017 IEEE 60th International Midwest Symposium on Circuits and

Systems (MWSCAS), 2017, pp. 1264-1267, doi:

10.1109/MWSCAS.2017.8053160

[26] W. A. Farag, "CANTrack: Enhancing automotive CAN bus security using intuitive encryption algorithms," 2017 7th International Conference on Modeling, Simulation, and Applied Optimization (ICMSAO), 2017, pp. 1-5, doi:

Short Paper—Paper Formatting for online-journals.org

10.1109/ICMSAO.2017.7934878 [27] S. Woo, H. J. Jo, I. S. Kim and D. H. Lee, "A Practical Security Architecture for

In-Vehicle CAN-FD," in IEEE Transactions on Intelligent Transportation Systems, vol.

17, no. 8, pp. 2248-2261, Aug. 2016, doi: 10.1109/TITS.2016.2519464

[28] Bridges, R. A., Glass-Vanderlan, T. R., Iannacone, M. D., Vincent, M. S., & Chen,

Q. (Guenevere). (2019). A Survey of Intrusion Detection Systems Leveraging Host

Data. ACM Computing Surveys, 52(6), 1–35.

[29] W. Wu et al., "A Survey of Intrusion Detection for In-Vehicle Networks," in IEEE

Transactions on Intelligent Transportation Systems, vol. 21, no. 3, pp. 919-933,

March 2020, doi: 10.1109/TITS.2019.2908074. [30] U. E. Larson, D. K. Nilsson and E. Jonsson, "An approach to specification-based

attack detection for invehicle networks," 2008 IEEE Intelligent Vehicles Symposium,

2008, pp. 220-225, doi: 10.1109/IVS.2008.4621263

[31] Clinton Young, Habeeb Olufowobi, Gedare Bloom, and Joseph Zambreno. 2019.

Automotive Intrusion Detection Based on Constant CAN Message Frequencies Across

Vehicle Driving Modes. In Proceedings of the ACM Workshop on Automotive Cyber-

security (AutoSec '19). Association for Computing Machinery, New York, NY, USA,

9–14. DOI:https://doi.org/10.1145/3309171.3309179

[32] Charlie Miller and Chris Valasek. 2016. OG Dynamite Edition. Retrieved August

2020 from http://illmatics.com/ can%20message%20injection.pdf. [33] M. Müter, A. Groll and F. C. Freiling, "A structured approach to anomaly detection

for in-vehicle networks," 2010 Sixth International Conference on Information Assur-

ance and Security, 2010, pp. 92-98, doi: 10.1109/ISIAS.2010.5604050.

[34] Navaz, A. S. Syed & Sangeetha, V. & Prabhadevi, C.. (2013). Entropy based

Anomaly Detection System to Prevent DDoS Attacks in Cloud. International Journal

of Computer Applications. 62. 42-47. 10.5120/101605084

[35] Studnia, I., Alata, E., Nicomette, V., Kaâniche, M., & Laarouchi, Y. (2018). A

language-based intrusion detection approach for automotive embedded networks. Int.

J. Embed. Syst., 10, 1-12

[36] Dagan, T. (2016). Parrot , a software-only anti-spoofing defense system for the

CAN bus. [37] Tomlinson, Andrew & Bryans, Jeremy & Shaikh, Siraj. (2018). Towards Viable

Intrusion Detection Methods For The Automotive Controller Area Network.

10.1145/3273946.3273950.

[38] H. Ji, Y. Wang, H. Qin, Y. Wang and H. Li, "Comparative Performance Evaluation

of Intrusion Detection Methods for In-Vehicle Networks," in IEEE Access, vol. 6, pp.

37523-37532, 2018, doi: 10.1109/ACCESS.2018.2848106

[39] Ling, Congli & Feng, Dongqin. (2012). An Algorithm for Detection of Malicious Messages on CAN Buses. 10.2991/citcs.2012.161

[40] Gmiden, M. H. Gmiden and H. Trabelsi, "An intrusion detection method for se-

curing in-vehicle CAN bus," 2016 17th International Conference on Sciences

and Techniques of Automatic Control and Computer Engineering (STA), 2016, pp. 176-

180, doi:10.1109/STA.2016.7952095

[41] Kyong-Tak Cho and Kang G. Shin. 2016. Fingerprinting electronic control units

for vehicle intrusion detection. In Proceedings of the 25th USENIX Conference on Se-

curity Symposium (SEC'16 ). USENIX Association, USA, 911–927.

Short Paper—Paper Formatting for online-journals.org

[42] M. Müter and N. Asaj, "Entropy-based anomaly detection for in-vehicle net-

works," 2011 IEEE Intelligent Vehicles Symposium (IV), 2011, pp. 11101115,

doi: 10.1109/IVS.2011.5940552

[43] W. Wu et al., "Sliding Window Optimized Information Entropy Analysis Method

for Intrusion Detection on InVehicle Networks," in IEEE Access, vol. 6, pp.

4523345245, 2018,doi:10.1109/ACCESS.2018.2865169.

[44] D. Stabili, M. Marchetti and M. Colajanni, "Detecting attacks to internal vehicle networks through Hamming distance," 2017 AEIT International Annual Conference,

2017, pp. 1-6, doi: 10.23919/AEIT.2017.8240550.

[45] S. N. Narayanan, S. Mittal and A. Joshi, "OBD_SecureAlert: An Anomaly Detec-

tion System for Vehicles," 2016 IEEE International Conference on Smart Computing

(SMARTCOMP), 2016, pp. 1-6, doi:10.1109/SMARTCOMP.2016.7501710.

[46] M. L. Bujorianu, R. Wisniewski and E. Boulougouris, "Stochastic Safety for Mar-

kov Chains," in IEEE Control Systems Letters, vol. 5, no. 2, pp. 427-432, April 2021, doi: 10.1109/LCSYS.2020.3002475

[47] Kang M-J, Kang J-W (2016) Intrusion Detection System Using Deep Neural Net-

work for In-Vehicle Network Security. PLoS ONE 11(6): e0155781.

https://doi.org/10.1371/journal.pone.0155781

[48] Tian D. et al. (2018) An Intrusion Detection System Based on Machine Learning

for CAN-Bus. In: Chen Y., Duong T. (eds) Industrial Networks and Intelligent Systems.

INISCOM 2017. Lecture Notes of the Institute for Computer Sciences, Social Infor- matics and Telecommunications Engineering, vol 221. Springer, Cham.

https://doi.org/10.1007/978-3-31974176-5_25

[49] Nowdehi, A. Lautenbach and T. Olovsson, "In-Vehicle CAN Message Authenti-

cation: An Evaluation Based on Industrial Criteria," 2017 IEEE 86th Vehicular

Technology Conference (VTC-Fall), 2017, pp. 1-7, doi:

10.1109/VTCFall.2017.8288327. [50] D. Wang and S. Ganesan, "Automotive Network Security," 2021 IEEE Interna-

tional Conference on Electro Information Technology (EIT), 2021, pp. 193196,

doi: 10.1109/EIT51626.2021.9491889

[51] S. Jafarnejad, L. Codeca, W. Bronzi, R. Frank and T. Engel, "A Car Hacking Ex-

periment: When Connectivity Meets Vulnerability," 2015 IEEE Globecom Workshops

(GC Wkshps), 2015, pp. 1-6, doi:10.1109/GLOCOMW.2015.7413993

[52] Reiner Zitzmann. 2019. CiA CANopenFD Integration Workshop. Technical Re-

port. CAN in Automation. Retrieved August 2020 from https://www.automa.cz/down-

loads/streda15-00.pdf