CASAD: CAN-Aware Stealthy-Attack Detection for In-Vehicle Networks
This addresses the safety-critical issue of cyber-attacks in vehicles for passengers and the automotive industry, offering a deployable solution that overcomes configuration dependencies and stealthy attack detection limitations, though it appears incremental relative to existing countermeasures.
The paper tackles the problem of detecting stealthy cyber-attacks in in-vehicle networks (IVNs) by proposing CASAD, a system-agnostic detection mechanism that learns normal behavior from historical data and monitors traffic for deviations. The result is a fast, lightweight approach shown to be effective in experiments on a CAN bus prototype, a 2018 Volvo XC60, and public vehicle data, including prompt detection of stealthy attacks.
Nowadays, vehicles have complex in-vehicle networks (IVNs) with millions of lines of code controlling almost every function in the vehicle including safety-critical functions. It has recently been shown that IVNs are becoming increasingly vulnerable to cyber-attacks capable of taking control of vehicles, thereby threatening the safety of the passengers. Several countermeasures have been proposed in the literature in response to the arising threats, however, hurdle requirements imposed by the industry is hindering their adoption in practice. In particular, detecting attacks on IVNs is challenged by strict resource constraints and utterly complex communication patterns that vary even for vehicles of the same model. In addition, existing solutions suffer from two main drawbacks. First, they depend on the underlying vehicle configuration, and second, they are incapable of detecting certain attacks of a stealthy nature. In this paper, we propose CASAD, a CAN-Aware Stealthy-Attack Detection mechanism that does not abide by the strict specifications predefined for every vehicle model and addresses key real-world deployability challenges. Our fast, lightweight, and system-agnostic approach learns the normal behavior of IVN dynamics from historical data and detects deviations by continuously monitoring IVN traffic. We demonstrate the effectiveness of CASAD by conducting various experiments on a CAN bus prototype, a 2018 Volvo XC60, and publicly available data from two real vehicles. Our approach is experimentally shown to be effective against different attack scenarios, including the prompt detection of stealthy attacks, and has considerable potential applicability to real vehicles.