PaperlayerView exact revision on arXiv

Source-linked AI summary

Identifying ECUs Using Inimitable Characteristics of Signals in Controller Area Networks

Wonsuk Choi, Hyo Jin Jo, Samuel Woo, Ji Young Chun, Jooyoung Park, Dong Hoon Lee

arXiv:1607.00497v1cs.CR

TL;DR

CAN lacks feasible message authentication and is therefore vulnerable to ECU impersonation and replay attacks. The paper identifies ECUs from inimitable physical-layer signal characteristics using a monitoring unit added to the existing network. The method improves identification accuracy over prior work, while its main scope limitation is reliance on the extended frame format and associated firmware updates.

  • Problem

    CAN lacks message authentication, and its data frames are too short for an effective MAC, leaving the network vulnerable to ECU impersonation and replay attacks.

  • Method

    The method uses inimitable physical-layer signal characteristics and an added monitoring unit to classify ECU transmitters without replacing existing ECU hardware.

  • Results

    The method achieved a misclassification rate of up to 15%, mostly below 5%, compared with up to 99.9% for Murvay et al.’s method in the Type II adversary model.

  • Takeaways & Limitations

    The approach supports ECU impersonation detection while remaining applicable to existing CAN systems without ECU hardware replacement.

  • Takeaways & Limitations

    The method uses the extended frame format, so current networks require ECU firmware updates even though hardware replacement is unnecessary.

Abstract

from arXiv · show

In the last several decades, the automotive industry has come to incorporate the latest Information and Communications (ICT) technology, increasingly replacing mechanical components of vehicles with electronic components. These electronic control units (ECUs) communicate with each other in an in-vehicle network that makes the vehicle both safer and easier to drive. Controller Area Networks (CANs) are the current standard for such high quality in-vehicle communication. Unfortunately, however, CANs do not currently offer protection against security attacks. In particular, they do not allow for message authentication and hence are open to attacks that replay ECU messages for malicious purposes. Applying the classic cryptographic method of message authentication code (MAC) is not feasible since the CAN data frame is not long enough to include a sufficiently long MAC to provide effective authentication. In this paper, we propose a novel identification method, which works in the physical layer of an in-vehicle CAN network. Our method identifies ECUs using inimitable characteristics of signals enabling detection of a compromised or alien ECU being used in a replay attack. Unlike previous attempts to address security issues in the in-vehicle CAN network, our method works by simply adding a monitoring unit to the existing network, making it deployable in current systems and compliant with required CAN standards. Our experimental results show that the bit string and classification algorithm that we utilized yielded more accurate identification of compromised ECUs than any other method proposed to date. The false positive rate is more than 2 times lower than the method proposed by P.-S. Murvay et al. This paper is also the first to identify potential attack models that systems should be able to detect.

I. INTRODUCTION

The paper addresses CAN’s lack of feasible message authentication by proposing a physical-layer ECU identification method that adds a monitoring unit without replacing existing ECUs. It extends prior work to high-speed, collision-aware conditions while preserving CAN compatibility.

  • CAN lacks message authentication, while its short data frames make effective MAC-based authentication infeasible.
  • The proposed method identifies ECUs from inimitable physical-layer signal characteristics using an add-on monitoring unit compatible with current CAN systems.
  • The introduction positions the method as directly applicable to current vehicles and compliant with existing CAN standards.
  • The method improves on prior work by operating at the 500K b/s high-speed CAN rate and analyzing signals under collisions.
  • It requires only an additional device and does not require replacing installed ECUs.

II. MOTIVATIONS

CAN permits ECU impersonation because messages lack authentication, creating risks that adversaries can control vehicle functions. The paper therefore identifies transmitters through analog signal characteristics while retaining compatibility with existing CAN systems.

  • CAN’s lack of authentication lets ECUs impersonate one another and leaves the network open to replay and malicious-message attacks.
  • Such attacks can compromise vehicle functions including the engine, brakes, lights, locks, and passenger-safety systems.
  • The method extracts each ECU’s analog signal characteristics in the physical layer to identify impersonators and their transmitting devices.
  • The approach supports intrusion detection, authentication, forensic data collection, and quality-assurance monitoring.

III. BACKGROUNDS

The background explains why ECU identification can use CAN’s physical-layer signal variations and transmitter identifiers. It introduces CAN communication and the frame structure relevant to the proposed method.

  • The paper studies device inconsistencies and CAN operation to motivate identification from distinctive analog and digital signal characteristics.
  • CAN is a cost-effective automotive communication bus now used across industries, and its physical layer is central to this method.
  • CAN uses NRZ encoding over CAN-H and CAN-L, with distinct voltage states representing recessive and dominant bits.

2) Data Frame Format:

CAN data frames identify transmitters through identifier fields, but arbitration can make the standard identifier ambiguous when multiple ECUs transmit simultaneously. The extended frame format supplies the EXID field used by the proposed method to measure ECU-specific signals.

  • 2) Data Frame Format:: The CAN defines data, remote, error, and overload frames, but the paper focuses on data frames because the method identifies the ECU transmitting data.
  • 2) Data Frame Format:: Table I presents the fields of the extended frame format used to organize the identifier and EXID components.
  • 2) Data Frame Format:: CAN data frames use transmitter identifiers, and the paper distinguishes base frames with 11 identifier bits from extended frames with 29 bits, including an 18-bit EXID.The method measures signals corresponding to the EXID rather than the standard identifier field.
  • 3) Arbitration / Extended Identifier:: When ECUs transmit simultaneously, CAN resolves collisions through lossless bitwise arbitration, giving dominant 0 bits priority over recessive 1 bits.
  • 3) Arbitration / Extended Identifier:: In the illustrated collision, ECU A wins when its dominant bit differs from ECU B’s recessive bit at the sixth identifier position, cutting off ECU B’s signal.
  • 3) Arbitration / Extended Identifier:: Before arbitration resolves the collision, shared signal portions in the identifier field cannot be uniquely attributed to one ECU.

IV. SYSTEM MODEL

The system adds a monitoring unit to the existing CAN and uses signal features plus known identifier-to-ECU pairings to detect invalid transmitters. It learns ECU fingerprints from repeated messages and raises an alarm when a signal’s physical characteristics do not match its expected source.

  • IV. SYSTEM MODEL: The monitoring unit analyzes all sent messages, extracts known identifiers, and classifies signal features associated with the extended identifier field.The same message is sent repeatedly so the classifier can learn ECU-specific fingerprint templates.
  • IV. SYSTEM MODEL: The workflow extracts ECU signal characteristics, identifies ECUs using those characteristics, and sends an alarm when an invalid ECU is detected.
  • IV. SYSTEM MODEL: Figure 4 depicts the system model in which the monitoring unit is added to the CAN network.
  • IV. SYSTEM MODEL: ECU fingerprints pair distinctive signal characteristics with the identifiers and functions that each ECU is expected to transmit.Examples include engine commands from ECU 1 and brake-control signals from ECU 2.
  • IV. SYSTEM MODEL: The system detects an invalid ECU when a signal uses an expected identifier but its measured characteristics do not originate from the paired ECU.
  • IV. SYSTEM MODEL: Because ECUs share one bus line, the method can be applied to current vehicle systems by adding the monitor and adjusting ECU programming to include the extended identifier field.

A. Adversary Models

The paper models replay threats according to how an adversary accesses the CAN network, distinguishing an external device from a compromised existing ECU. The method is designed around identifying mismatches between signal fingerprints and ECU identifiers, including under stated extended-frame assumptions.

  • A. Adversary Models: The attack goal is to transmit malicious commands through replay attacks because CAN lacks message authentication.
  • A. Adversary Models: Type I attackers connect external devices through access points such as the OBD-II port, laptops, or smartphones to transmit malicious commands.
  • A. Adversary Models: Type II attackers compromise an existing ECU and use it to imitate signal features while transmitting messages from the wrong ECU.
  • A. Adversary Models: The paper treats Type I as a lesser threat than Type II because visible external devices may be noticed and removed, while compromised ECUs are harder to localize and eradicate.
  • A. Adversary Models: The method uses the extended frame format because the base identifier alone does not properly identify signal characteristics.
  • A. Adversary Models: It assumes arbitration occurs in the 11-bit identifier field and that the 18-bit extended identifier remains unaffected by arbitration decisions.

V. OUR METHOD

The method extracts statistical features from physical CAN signals and uses selected time- and frequency-domain features as ECU fingerprints. It fixes the extended identifier length and bit pattern to standardize measured signals before classification.

  • V. OUR METHOD: The method extracts statistical features from CAN transceiver signals and classifies the resulting unique signal patterns for ECU identification.
  • V. OUR METHOD: The measured extended-identifier signal is represented as a fixed-length 18-bit string whose most significant bit is zero to prevent different bit-stuffing locations.The remaining 17 bits may be either 0 or 1.
  • V. OUR METHOD: The sampled physical signal is denoted S(k), and the bit-string constraints define the input signal measured from the extended identifier field.
  • V. OUR METHOD: The method extracts 40 time- and frequency-domain features, ranks them with FEAST using joint mutual information, and selects 8 time-domain plus 9 frequency-domain features.
  • V. OUR METHOD: Table II lists time-domain features based on the time-domain representation x and its N elements.
  • V. OUR METHOD: Table III lists frequency-domain features using magnitude coefficients ym and bin frequencies yf, each defined over N elements.
  • V. OUR METHOD: The selected feature set F(S) corresponding to each measured signal serves as the ECU fingerprint.

C. Fingerprint template generation

The method generates ECU fingerprint templates from signal features, then matches new signals against known templates to detect alien or mismatched devices.

  • C. Fingerprint template generation: The classifier averages variations across 900 signals from each of 12 ECUs into fingerprint templates.Each signal supplies 17 features, and template generation is performed during vehicle manufacture or after ECU changes.
  • D. Fingerprint Matching: New signals are matched against previously learned fingerprints during the testing phase.
  • D. Fingerprint Matching: For Type I adversaries, threshold-based novelty detection identifies signals that match none of the known fingerprint templates.An unmatched signal indicates an alien device or invalid ECU.
  • D. Fingerprint Matching: The monitoring unit classifies a feature set as unknown when all matching scores fall below the threshold.
  • D. Fingerprint Matching: For Type II attacks, a probabilistic model selects the known fingerprint that most closely matches a new signal.This tests whether a known signal is being transmitted by the wrong ECU.
  • D. Fingerprint Matching: The two attack models differ by whether thresholding detects an external unknown device or probabilistic matching detects a compromised existing ECU.

VI. EXPERIMENTAL RESULTS

The experiments evaluated detection of alien signals and correct ECU-signal matching using high-speed CAN data, multiple classifiers, and cross-validation.

  • VI. EXPERIMENTAL RESULTS: Both adversary types achieved success rates above 90% in the experiments.The authors argue repeated malicious transmissions make these detection rates useful for identifying attacks.
  • VI. EXPERIMENTAL RESULTS: The evaluation used more than 900 observations from each of 12 CAN development boards at the 500K bit rate.This rate represents high-speed in-vehicle CAN operation.
  • VI. EXPERIMENTAL RESULTS: SVM, NN, and BDT classifiers were evaluated using averaged 10-fold cross-validation accuracy.Each fold served once as validation data after training on the other nine folds.
  • VI. EXPERIMENTAL RESULTS: Table IV documents the experimental components and their specifications for evaluating both adversary models.

B. Basic Identification

Basic identification uses collision-resistant extended-identifier signals, extracts statistical features, and classifies them with three supervised methods.

  • B. Basic Identification: Overall success rates are also reported across different extended-identifier bit strings and the three classification algorithms.
  • B. Basic Identification: The extended identifier field provides an unambiguous signal because transmitted messages have already passed arbitration.The monitoring unit therefore analyzes a signal generated by a single ECU in this field.
  • B. Basic Identification: The method extracts statistical features from extended-identifier signals and classifies them using SVM, NN, and BDT.
  • B. Basic Identification: The confusion matrix reports success and misclassification rates for the three classifiers, with diagonal cells representing valid-ECU classification success.
  • B. Basic Identification: Misclassification reached up to 15% and was mostly below 5%, compared with up to 99.9% for Murvay et al.This comparison applies to the Type II adversary model.

C. Identifying known ECUs

The study examines how extended-identifier bit strings affect known-ECU identification and evaluates unknown-ECU detection using threshold-based novelty detection.

  • C. Identifying known ECUs: Success rates vary with the bit string assigned to the extended identifier field.
  • C. Identifying known ECUs: The bit-string comparison evaluates overall success rates across SVM, NN, and BDT configurations.
  • C. Identifying known ECUs: Figure 6 presents false-negative and false-positive rates as the detection threshold changes.
  • C. Identifying known ECUs: The highest known-ECU success rate occurs with the all-zero bit string and NN using 100 hidden layers.The all-zero and alternating bit strings both produce acceptable success rates.
  • C. Identifying known ECUs: For Type I attacks, the method must classify a newly attached OBD-II device as an unknown class through novelty detection.
  • C. Identifying known ECUs: SVM with a linear kernel or BDT with 100 classifiers produces the most acceptable alien-device detection result, while NN has an EER of 0.38 at threshold 0.9999.
  • C. Identifying known ECUs: The work extends prior device-fingerprinting research, including Murvay et al.'s CAN source-identification method.The paper positions its evaluation as addressing insufficient success rates and limited simulation of critical CAN functions in prior work.

VIII. LIMITATION AND FUTURE WORKS

The method avoids ECU hardware replacement and can be applied to current CAN systems, but its use of the extended frame format requires firmware updates in existing vehicles.

  • Using the extended frame format requires ECU firmware updates because current in-vehicle networks use the base frame format.New vehicles would need new programming, while older cars would require reprogramming.
  • Future work will seek a method using the base frame format, potentially avoiding firmware updates if it provides a sufficiently long fixed bit string.The current method assigns one ECU to one class and therefore requires a fixed bit string for each ECU.
  • The method does not require replacing existing ECU hardware, supporting application to current in-vehicle CAN systems.The authors describe the approach as directly applicable while minimizing deployment cost.
Loading 1607.00497v1…