Source-linked AI summary
Viden: Attacker Identification on In-Vehicle Networks
Kyong-Tak Cho, Kang Shin
TL;DR
Existing vehicle-security defenses can detect in-vehicle intrusions but generally cannot identify the attacking ECU, limiting targeted forensic and remediation actions. Viden addresses this gap by using CAN voltage measurements, ACK learning, and adaptive transmitter voltage profiles as ECU fingerprints. Evaluations on a CAN prototype and two real vehicles achieved a 0.2% false identification rate. The approach is scoped by its need for at least one usable voltage profile and may be inaccurate when a compromised ECU sends no messages or when stale profiles require reconstruction.
Problem
Existing defenses can determine whether an in-vehicle intrusion occurred but cannot identify the attacking ECU, which is needed for forensic analysis, isolation, and security patching.
Method
Viden uses CAN voltage measurements, ACK learning, and adaptive voltage profiles that fingerprint transmitter ECUs for attacker identification.
Results
0.2% false identification rate was achieved on a CAN bus prototype and two real vehicles.
Takeaways & Limitations
Viden provides an adaptive and practical voltage-fingerprinting approach for identifying attacker ECUs across attack scenarios.
Takeaways & Limitations
Viden may identify attackers inaccurately when the compromised ECU sends no messages, and stale voltage profiles may require reconstruction after long shutdowns.
Abstract
from arXiv · showhide
Various defense schemes --- which determine the presence of an attack on the in-vehicle network --- have recently been proposed. However, they fail to identify which Electronic Control Unit (ECU) actually mounted the attack. Clearly, pinpointing the attacker ECU is essential for fast/efficient forensic, isolation, security patch, etc. To meet this need, we propose a novel scheme, called Viden (Voltage-based attacker identification), which can identify the attacker ECU by measuring and utilizing voltages on the in-vehicle network. The first phase of Viden, called ACK learning, determines whether or not the measured voltage signals really originate from the genuine message transmitter. Viden then exploits the voltage measurements to construct and update the transmitter ECUs' voltage profiles as their fingerprints. It finally uses the voltage profiles to identify the attacker ECU. Since Viden adapts its profiles to changes inside/outside of the vehicle, it can pinpoint the attacker ECU under various conditions. Moreover, its efficiency and design-compliance with modern in-vehicle network implementations make Viden practical and easily deployable. Our extensive experimental evaluations on both a CAN bus prototype and two real vehicles have shown that Viden can accurately fingerprint ECUs based solely on voltage measurements and thus identify the attacker ECU with a low false identification rate of 0.2%.
1 Introduction
Viden addresses the inability of existing in-vehicle intrusion defenses to identify the attacking ECU by fingerprinting transmitters from CAN voltage measurements. It adaptively updates voltage profiles and achieves practical, accurate attacker identification.
- Motivation: Existing defenses detect in-vehicle intrusions but cannot identify the attacking ECU because CAN broadcasts omit transmitter information.Identifying the attacker supports faster forensic analysis, isolation, and security patching.
- Viden: Viden fingerprints CAN transmitter ECUs using voltage measurements that capture inherent differences in their voltage outputs.The scheme monitors CAN-High and CAN-Low voltages and uses ACK learning to retain measurements from genuine transmitters.
- Adaptability: Online adaptive signal processing lets Viden modify fingerprints in response to natural or adversarial changes inside or outside the vehicle.This contrasts with batch-trained voltage fingerprints that remain unchanged until retrained.
- Practicality: Viden avoids restrictions on CAN message type, bus speed, sampled message fields, and CAN-controller redesign, supporting low-cost deployment.Its message-field-agnostic filtering uses derived ACK thresholds and can operate at a low voltage sampling rate.
- Evaluation: 0.2% false identification rate was achieved on a CAN bus prototype and two real vehicles.The evaluation attributes the result to Viden’s adaptive fingerprinting across attack scenarios.
- Viden: Viden constructs voltage profiles by modeling normal ECU voltage behavior and exploits those profiles to identify attacker ECUs.The profiles serve as ECU fingerprints and are updated as operating conditions change.
2 Background
CAN transceivers encode bits through differential voltages on CANH and CANL, while ECU-specific hardware variation can support voltage fingerprinting. Prior timing- and voltage-based approaches had deployment or attacker-identification limits that Viden targets.
- CAN Message Transmission: CAN frames identify message priority rather than transmitter or receiver addresses, and all receiving ECUs acknowledge messages in the ACK slot.The transmitter ECU does not participate in the ACK slot, which distinguishes that slot from the rest of the frame transmission.
- CAN Message Transmission: A CAN transceiver sends a 0-bit with approximately 3.5V on CANH and 1.5V on CANL, producing approximately 2V differential voltage.For a 1-bit, both wires are approximately 2.5V, yielding approximately 0V differential voltage.
- CAN Transceiver: Transceivers create CAN voltages by switching high- and low-side transistor circuits, which share the bus load resistance across ECUs.When sending a 1-bit the transistors are high impedance; for a 0-bit they are low impedance and current flows through the load.
- Prior Work: Earlier timing fingerprints were mainly designed for intrusion detection, while Viden targets attacker identification from ECU output voltages.The paper states that prior approaches can detect attacks without correctly identifying the attacker in some scenarios.
- Prior Work: Prior voltage methods faced restrictions involving message IDs, low-speed CAN, supervised batch learning, or impractical deployment conditions.Viden instead uses online updates, 50 KSamples/sec sampling, and no restrictions on message type or CAN speed.
3 Viden
Viden identifies attacker ECUs by fingerprinting CAN message transmitters from their voltage outputs. It builds adaptive voltage profiles designed for practical deployment under varying vehicle conditions.
- Motivation: Viden addresses the inability of existing intrusion defenses to identify which ECU mounted an attack on broadcast in-vehicle networks.Attacker identification supports forensic analysis, isolation, and security patching.
- Threat model: The threat model includes attackers attempting arbitrary or targeted ECU impersonation after compromising an ECU remotely.Timing-voltage-aware attackers may alter voltage outputs but cannot precisely control instantaneous values or resistor values without physical access.
- System overview: Viden operates in four phases: ACK-threshold learning, transmitter-only voltage selection, voltage-profile updating, and optional multi-class verification.The phases run during initialization or updates and then iteratively during operation.
- System overview: Viden fingerprints CAN message transmitter ECUs using their voltage measurements and maps attack-message profiles to stored ECU profiles.The scheme focuses on CAN, the de facto in-vehicle networking standard.
- Voltage fingerprints: Small inherent differences in ECU supply, ground, and transistor resistance produce distinct CANH and CANL dominant voltages for fingerprinting.Viden models these normal voltage-output behaviors as ECU-specific voltage profiles.
3.4 Phase 1: ACK Threshold Learning
Phase 1 learns ACK thresholds so Viden can distinguish voltage samples produced by the genuine message transmitter from samples produced during the ACK slot. It derives thresholds from repeated dominant-voltage measurements for each message ID.
- Threshold learning: Phase 1 maps CANH and CANL measurements to the received message ID and learns an ACK threshold for that ID.The threshold determines whether a measured voltage originated from the actual transmitter.
- Voltage collection: Viden excludes non-dominant samples, retaining CANH values above 2.75V and CANL values below 2.25V during message reception.Measurement continues until the received message enters Viden’s receive buffer.
- ACK separation: ACK-slot samples are excluded because all non-transmitter ECUs output a dominant bit during acknowledgment, producing voltages unlike the transmitter’s non-ACK outputs.In an example, Viden discarded 2.6V and 2.5V as non-dominant but recognized 3.8V as an ACK-slot sample.
- Threshold derivation: The most frequent values form S_freq, while maximum or minimum values form sets used to expose the ACK-related side lobe.The procedure refines the maximum set and combines statistical limits to derive a conservative threshold.
- Threshold derivation: 3.499V is the example CANH ACK threshold, separating the two lobes in the prototype’s maximum-voltage distribution.Thresholds can differ by transmitter because the set of responding ECUs differs, so learning is performed for message IDs of interest.
3.5 Phase 2: Deriving a Voltage Instance
Phase 2 derives voltage instances from transmitter-only dominant voltages and uses them to represent the transmitter ECU’s current voltage-output behavior. The representation tracks central values and selected distribution percentiles over time.
- Non-ACK selection: After ACK thresholds are learned, Viden discards CANH and CANL samples outside the transmitter-only non-ACK ranges.CANH values below 2.75V or above its ACK threshold, and CANL values above 2.25V or below its ACK threshold, are rejected.
- Voltage instance: Each batch of κ new CANH and CANL measurements produces a voltage instance containing six tracking points, F1–F6.The instance summarizes the transmitter’s voltage output behavior for profile updating.
- Central values: F1 and F2 track the most frequent CANH and CANL values, representing the median of the transmitter’s dominant-voltage outputs.Only non-ACK samples are used after threshold learning.
- Dispersion: F3–F6 track CANH percentiles 75 and 90 and CANL percentiles 25 and 10 to capture output dispersion.These percentiles reflect changes in the transmitter’s voltage distribution while limiting tracking overhead.
- Dispersion: Viden updates dispersion tracking points using past κR measurements and adjusts them toward target percentiles with sensitivity controlled by α.The tracking approach reduces sensitivity to transient changes when samples are insufficient.
3.6 Phase 3: Attacker Identification
Phase 3 constructs adaptive voltage profiles from transmitter behavior and compares attack-time measurements with learned profiles to identify the attacker ECU.
- Voltage profile construction: A voltage instance captures the message transmitter’s momentary voltage output behavior, and newly derived instances update its voltage profile.Instances are derived per message ID but are near-equivalent when messages originate from the same ECU.
- Voltage profile construction: CVDs measure cumulative deviations of dominant voltages from ideal values for features F1–F6.The update uses elapsed time, the current feature value, and its desired value.
- Transient suppression: Summing the six CVDs suppresses transient CANH/CANL deviations caused by driver or temperature changes during profile construction.Because CAN is differential, corresponding CANH and CANL feature deviations oppose one another.
- Voltage profile construction: Viden models the accumulated, transient-suppressed signal as linear in time, whose transmitter-dependent slope becomes the ECU’s voltage profile.Recursive Least Squares learns this regression parameter online, enabling continuous fingerprint updates.
- Attacker identification: After intrusion detection, Viden builds an intrusion voltage profile from attack-message outputs and matches it against previously learned profiles to identify the attacker ECU.The method’s performance depends on the underlying IDS detecting the intrusion; an unknown profile can occur for an adversary-attached ECU.
3.7 Phase 4: Verification
Phase 4 verifies attacker identification using momentary voltage instances when voltage-profile matching is ambiguous, while Viden adjusts profiles online to address changing conditions.
- 3.7 Phase 4: Verification: Voltage-profile collisions can make different ECUs appear similar, so Phase 4 uses F1–F6 momentary voltage instances in machine classifiers for further verification.This complements, rather than replaces, the adaptive trend-based fingerprinting of Phase 3.
- 3.7 Phase 4: Verification: Continuous real-time profile updates minimize model-exam discrepancy between the latest fingerprint and voltage measurements obtained during a detected attack.Viden also suppresses transient changes and adapts its model during abrupt ECU temperature changes.
- 3.7 Phase 4: Verification: After an intrusion is detected, Viden identifies the attacker ECU using voltage measurements.The identification process relies on the intrusion being detected by the underlying IDS.
- 3.7 Phase 4: Verification: Timing-aware attackers can evade timing-based CIDS with aperiodic injections or clock imitation, but Viden identifies attackers irrespective of message timings.This gives voltage-based identification a distinct vantage point from timing-based fingerprinting.
- 3.7 Phase 4: Verification: Viden’s online fingerprint updates, profile adjustment, and combined trend and momentary analysis make evasion difficult for timing-voltage-aware adversaries.A corner case remains when the vehicle has been off for a long time, requiring profile readjustment from common voltage changes.
4 Evaluation
Viden was evaluated on a CAN prototype and two real vehicles, where voltage profiles distinguished transmitters and supported attacker identification under changing and impersonation scenarios.
- Evaluation setups: Experiments covered a CAN bus prototype and two real vehicles, including a 2013 Honda Accord and a 2015 Chevrolet Trax.The real-vehicle CAN buses operated at 500 Kbps, while Viden sampled CANH and CANL voltages.
- Voltage profiles as fingerprints: Voltage profiles differed across prototype nodes and grouped messages sent by the same ECU in the Honda Accord.The evaluation found distinct profiles for prototype nodes and equivalent profiles for messages sharing a transmitter ECU in the Accord.
- Voltage outputs in real vehicles: Voltage outputs were discernible across ECUs in both real vehicles despite deviations from nominal CANH=3.5V and CANL=1.5V dominant levels.The results support using measured CANH and CANL outputs as ECU fingerprints.
- Transient changes: Summing transiently opposite CANH and CANL deviations suppressed changes sufficiently for fingerprint construction, although sampling prevented complete removal.The tracked percentile values temporarily deviated and later returned to usual values.
- Arbitrary impersonation: Viden identified an impersonating attacker as ECU D when attack traffic imitating ECU A matched D’s transmitter profile.The result held when the adversary attempted to impersonate ECU A.
- Arbitrary impersonation: Viden realigned voltage profiles after battery-related shifts across evaluation dates, handling arbitrary impersonation after a long idle period.The initial profiles differed, while later profiles aligned after adjustment.
- Targeted impersonation: 0.2% false identification rate was achieved on 1000 targeted impersonation attempts, rising to 0.3% with 11 ECUs.Viden combined voltage profiles with a 200-tree Random Forest using voltage instances, and mitigated profile collisions and targeted impersonation.
5 Discussion
The discussion identifies deployment boundaries involving CAN architecture, message assignment, intrusion-detection complementarity, cross-network attacks, and unavailable transmitter profiles.
- Number of ECUs on CAN: Modern CAN buses commonly contain 3–20 ECUs, while vehicles may distribute ECUs across multiple CAN buses.The evaluation considered a similar ECU count per CAN bus.
- Multiple ECUs per ID: Viden may underperform when multiple ECUs send the same message ID, because it would otherwise construct one profile for that ID.Known scheduling information can allow separate profiles to be constructed accordingly.
- Intrusion Detection: Viden complements timing-based intrusion detection by identifying transmitters, with greatest potential when used for attacker identification.Timing-based IDSs detect periodic-message attacks but fail on aperiodic messages.
- Attacker from Another In-vehicle Network: For attacks originating on another in-vehicle network, Viden identifies the gateway ECU injecting messages into CAN rather than the original compromised ECU.Routing tables are needed to identify the compromised network in this scenario.
- Limitations: Viden requires at least one voltage profile and may inaccurately identify an attacker ECU that sends no messages.Manufacturing-stage profiles and later voltage-profile adjustments are described as a possible remedy.
6 Conclusion
Viden uses ACK learning to isolate genuine transmitter voltage measurements, builds voltage profiles as ECU fingerprints, and identifies attackers. Evaluations on a CAN prototype and two real vehicles produced a 0.2% false identification rate.
- Conclusion: Viden’s ACK learning obtains voltage measurements only from genuine message transmitters before constructing voltage profiles.These profiles serve as ECU fingerprints for attacker identification.
- Conclusion: Viden identified attacker ECUs using voltage profiles evaluated on a CAN bus prototype and two real vehicles.
- Conclusion: 0.2% false identification rate was achieved in the reported evaluations.
A ACK threshold learning in a real vehicle
Viden derives ACK thresholds from voltage distributions measured in a 2013 Honda Accord. The refined thresholds separate ACK-slot voltages from other measurements on both CANH and CANL lines.
- ACK threshold derivation: Viden learns ACK thresholds before producing voltage instances and profiles by analyzing frequent and extreme voltage sets.The method exploits a side lobe present in the maximum/minimum distributions to represent ACK voltages.
- ACK threshold derivation: Figure 15 shows side lobes in both CANH and CANL voltage distributions for message 0x091 in the 2013 Honda Accord.
- ACK threshold derivation: 3.844V for CANH outputs and 1.114V for CANL outputs were derived as the ACK thresholds for message 0x091.
- ACK voltage levels: The Honda Accord’s median ACK voltages were 4.049V on CANH and 0.953V on CANL.The CANH median exceeded the 3.514V median measured on the CAN prototype, which had three acknowledging nodes.
B Voltage profiles while driving
Viden’s voltage profiles for message 0x191 were compared when a 2013 Honda Accord was stationary and driven. The profiles were equivalent across these conditions.
- Measurement conditions: Voltage instances of message 0x191 were collected from the 2013 Honda Accord while stationary and while driving for approximately 10 minutes.
- Profile comparison: Equivalent voltage profiles for message 0x191 were obtained under stationary and driving conditions.Figure 16 presents the two profiles for comparison.
- Profile stability: Hardware-component characteristics influence voltage outputs more than momentary vehicle conditions.Viden’s profile derivation suppresses transient deviations caused by changing momentary conditions.