Universally applicable signal-based controller area network (CAN) intrusion detection system

Patent metadata

Field	Value
Publication number	US-12282548-B2
Application number	US-202217725774-A
Country	US
Kind code	B2
Filing date	Apr 21, 2022
Priority date	Apr 23, 2021
Publication date	Apr 22, 2025
Grant date	Apr 22, 2025

Abstract

A system and method for intrusion detection on automotive controller area networks. The system and method can detect various CAN attacks, such as attacks that cause unintended acceleration, deactivation of vehicle's brakes, or steering the vehicle. The system and method detects changes in nuanced correlations of CAN timeseries signals and how they cluster together. The system reverse engineers CAN signals and detect masquerade attacks by analyzing timeseries extracted from raw CAN frames. Specifically, anomalies in the CAN data can be detected by computing timeseries clustering similarity using hierarchical clustering on the vehicle's CAN signals and comparing the clustering similarity across CAN captures with and without attacks.

First claim

The embodiments of the invention in which an exclusive property or privilege is claimed are defined as follows:

1. An intrusion detection system for detecting masquerade attacks on CAN data communicated over a vehicle controller area network (CAN) of a vehicle, the intrusion detection system comprising: a CAN transceiver configured to receive CAN frames from the vehicle CAN, wherein each CAN frame includes an arbitration identifier (AID) and an up to 64-bit data payload; a CAN controller in communication with the CAN transceiver;
a processor in communication with the CAN controller, wherein the processor is configured to generate a signal definition for each AID mapping the up to 64-bit data payloads of CAN frames with that AID to a plurality of tokenized and translated signals defined by one or more sequences of bits of the up to 64-bit data payload, wherein the mapping accounts for start bit, length, endianness, and signedness of the signals; wherein the processor is configured to (1) learn inherent relationships between uninterpreted timeseries signals in decoded CAN training payload data without dependence upon CAN diagnostic inquiry; (2) learn inherent relationships between uninterpreted timeseries signals in decoded CAN test payload data without dependence upon CAN diagnostic inquiry; (3) detect masquerade attacks on CAN test payload data based on a contrast of the learned inherent relationships of timeseries signals in the decoded CAN training payload data and the learned inherent relationships of timeseries signals in the decoded CAN test payload data; and (4) upon detecting a masquerade attack on CAN test payload data, at least one of transmit an anomaly-notification message and log information relating to the detected masquerade attack.

2. The intrusion detection system of claim 1 wherein the processor is configured to store the signal definition for each AID together with the AID in a CAN database file (DBC) in memory.

3. The intrusion detection system of claim 1 , wherein the payload of the CAN frames from the vehicle CAN are encoded based on unknown signal definitions established by a third party, each signal definition including information to tokenize, translate, and interpret the CAN data, where the information to tokenize includes information to demarcate sequences of bits corresponding to signals in the CAN data and byte ordering, wherein the information to translate includes information about how the sequences of bits were converted to integers.

4. The intrusion detection system of claim 1 , wherein the processor is configured to monitor, during operation of the vehicle, the timeseries signals in the decoded CAN test payload data for anomalies to detect masquerade attacks in the CAN test payload data, wherein the processor is configured to: compute correlations between timeseries signals in the decoded CAN test payload data; and compute agglomerative hierarchical clusterings for the computed correlations between the timeseries signals for the CAN test payload data; compute similarity between hierarchical clusterings for the computed correlations between the timeseries signals for the CAN test payload data; generate a CAN test data distribution of similarities between hierarchical clusterings for the correlations between the timeseries signals for CAN test payload data; compare the CAN test data distribution of similarities between hierarchical clusterings for the correlations between the timeseries signals for the CAN test payload data and CAN training payload data distribution of similarities between hierarchical clusters based on the CAN training payload data stored in memory; and
identify one or more anomalies of the timeseries signals for the CAN test payload data based on the comparison of the CAN test payload data distribution of similarities and the CAN training payload data distribution of similarities.

5. The intrusion detection system of claim 4 wherein the processor is configured to compute the agglomerative hierarchical clusterings based on at least one of a single linkage function, complete linkage function, average linkage function, and a Ward's linkage function.

6. The intrusion detection system of claim 4 wherein the processor is configured to interpolate the timeseries signals in the decoded CAN test payload data according to a selected base-line frequency to an equivalent length.

7. The intrusion detection system of claim 4 , wherein at least one of the respective timeseries for each of the CAN test payload data signals includes a correlated attack, speedometer attack, engine coolant attack, reverse light on attack, and reverse light off attack.

Assignees

• Ut Battelle Llc

Inventors

• Bridges Robert A
• Verma Kiren E
• Iannacone Michael
• Hollifield Samuel C
• Moriano Pablo
• Sosnowski Jordan

Classifications

• G06F21/552

  involving long-term monitoring or reporting · CPC title

• H04L12/40026 Primary

  Details regarding a bus guardian · CPC title

• H04L2012/40215

  Controller Area Network CAN · CPC title

• G06F21/554

  involving event detection and direct action · CPC title

• H04L67/12

  specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks · CPC title