Detection of Automotive CAN Cyber-Attacks by Identifying Packet Timing Anomalies in Time Windows

Andrew Tomlinson; Jeremy Bryans; Siraj Ahmed Shaikh; Harsha Kumara Kalutarage

doi:10.1109/DSN-W.2018.00069

Detection of Automotive CAN Cyber-Attacks by Identifying Packet Timing Anomalies in Time Windows

Andrew Tomlinson, Jeremy Bryans, Siraj Ahmed Shaikh, Harsha Kumara Kalutarage

Queen's University Belfast

Research output: Chapter in Book/Report/Conference proceeding › Conference proceeding › peer-review

43 Citations (Scopus)

Abstract

Cyber-attacks on the automotive controller area network (CAN) have recently been shown to be achievable and potentially disruptive or deadly. Detecting an attack quickly will require the development of intrusion detection systems that can cope with the rapid broadcast of CAN data, the comparatively limited computational power of automotive components, and the proprietary nature of CAN data specifications. This paper presents an analysis of CAN broadcasts and consequent testing of statistical methods to detect timing changes in the CAN traffic indicative of some predicted attacks. The detection is implemented in time-defined windows. The generation of simulated attack data, and the determination of positive detections, are also considered.

Original language	English
Title of host publication	Proceedings - 48th Annual IEEE/IFIP International Conference on Dependable Systems and Networks Workshops, DSN-W 2018
Place of Publication	Luxembourg
Publisher	IEEE
Pages	231-238
Number of pages	8
ISBN (Electronic)	978-1-5386-6553-4
ISBN (Print)	978-1-5386-6708-8
DOIs	https://doi.org/10.1109/DSN-W.2018.00069
Publication status	Published - 23 Jul 2018
Event	48th Annual IEEE/IFIP International Conference on Dependable Systems and Networks Workshops, DSN-W 2018 - Luxembourg City, Luxembourg Duration: 25 Jun 2018 → 28 Jun 2018

Conference

Conference	48th Annual IEEE/IFIP International Conference on Dependable Systems and Networks Workshops, DSN-W 2018
Country/Territory	Luxembourg
City	Luxembourg City
Period	25/06/18 → 28/06/18

Keywords

CAN
in-vehicle network
cybersecurity
anomaly detection

ASJC Scopus subject areas

Computer Networks and Communications
Hardware and Architecture
Safety, Risk, Reliability and Quality

Access to Document

10.1109/DSN-W.2018.00069

Cite this

Detection of Automotive CAN Cyber-Attacks by Identifying Packet Timing Anomalies in Time Windows. / Tomlinson, Andrew; Bryans, Jeremy; Shaikh, Siraj Ahmed et al.
Proceedings - 48th Annual IEEE/IFIP International Conference on Dependable Systems and Networks Workshops, DSN-W 2018. Luxembourg: IEEE, 2018. p. 231-238.

Research output: Chapter in Book/Report/Conference proceeding › Conference proceeding › peer-review

Tomlinson, A, Bryans, J, Shaikh, SA & Kalutarage, HK 2018, Detection of Automotive CAN Cyber-Attacks by Identifying Packet Timing Anomalies in Time Windows. in Proceedings - 48th Annual IEEE/IFIP International Conference on Dependable Systems and Networks Workshops, DSN-W 2018. IEEE, Luxembourg, pp. 231-238, 48th Annual IEEE/IFIP International Conference on Dependable Systems and Networks Workshops, DSN-W 2018, Luxembourg City, Luxembourg, 25/06/18. https://doi.org/10.1109/DSN-W.2018.00069

@inproceedings{4743b24b586d49d38b200e806ef20864,

title = "Detection of Automotive CAN Cyber-Attacks by Identifying Packet Timing Anomalies in Time Windows",

abstract = "Cyber-attacks on the automotive controller area network (CAN) have recently been shown to be achievable and potentially disruptive or deadly. Detecting an attack quickly will require the development of intrusion detection systems that can cope with the rapid broadcast of CAN data, the comparatively limited computational power of automotive components, and the proprietary nature of CAN data specifications. This paper presents an analysis of CAN broadcasts and consequent testing of statistical methods to detect timing changes in the CAN traffic indicative of some predicted attacks. The detection is implemented in time-defined windows. The generation of simulated attack data, and the determination of positive detections, are also considered.",

keywords = "CAN, in-vehicle network, cybersecurity, anomaly detection",

author = "Andrew Tomlinson and Jeremy Bryans and Shaikh, {Siraj Ahmed} and Kalutarage, {Harsha Kumara}",

year = "2018",

month = jul,

day = "23",

doi = "10.1109/DSN-W.2018.00069",

language = "English",

isbn = "978-1-5386-6708-8",

pages = "231--238",

booktitle = "Proceedings - 48th Annual IEEE/IFIP International Conference on Dependable Systems and Networks Workshops, DSN-W 2018",

publisher = "IEEE",

address = "United States",

note = "48th Annual IEEE/IFIP International Conference on Dependable Systems and Networks Workshops, DSN-W 2018 ; Conference date: 25-06-2018 Through 28-06-2018",

}

TY - GEN

T1 - Detection of Automotive CAN Cyber-Attacks by Identifying Packet Timing Anomalies in Time Windows

AU - Tomlinson, Andrew

AU - Bryans, Jeremy

AU - Shaikh, Siraj Ahmed

AU - Kalutarage, Harsha Kumara

PY - 2018/7/23

Y1 - 2018/7/23

N2 - Cyber-attacks on the automotive controller area network (CAN) have recently been shown to be achievable and potentially disruptive or deadly. Detecting an attack quickly will require the development of intrusion detection systems that can cope with the rapid broadcast of CAN data, the comparatively limited computational power of automotive components, and the proprietary nature of CAN data specifications. This paper presents an analysis of CAN broadcasts and consequent testing of statistical methods to detect timing changes in the CAN traffic indicative of some predicted attacks. The detection is implemented in time-defined windows. The generation of simulated attack data, and the determination of positive detections, are also considered.

AB - Cyber-attacks on the automotive controller area network (CAN) have recently been shown to be achievable and potentially disruptive or deadly. Detecting an attack quickly will require the development of intrusion detection systems that can cope with the rapid broadcast of CAN data, the comparatively limited computational power of automotive components, and the proprietary nature of CAN data specifications. This paper presents an analysis of CAN broadcasts and consequent testing of statistical methods to detect timing changes in the CAN traffic indicative of some predicted attacks. The detection is implemented in time-defined windows. The generation of simulated attack data, and the determination of positive detections, are also considered.

KW - CAN

KW - in-vehicle network

KW - cybersecurity

KW - anomaly detection

UR - http://www.scopus.com/inward/record.url?scp=85051234952&partnerID=8YFLogxK

U2 - 10.1109/DSN-W.2018.00069

DO - 10.1109/DSN-W.2018.00069

M3 - Conference proceeding

SN - 978-1-5386-6708-8

SP - 231

EP - 238

BT - Proceedings - 48th Annual IEEE/IFIP International Conference on Dependable Systems and Networks Workshops, DSN-W 2018

PB - IEEE

CY - Luxembourg

T2 - 48th Annual IEEE/IFIP International Conference on Dependable Systems and Networks Workshops, DSN-W 2018

Y2 - 25 June 2018 through 28 June 2018

ER -

Detection of Automotive CAN Cyber-Attacks by Identifying Packet Timing Anomalies in Time Windows

Abstract

Conference

Keywords

ASJC Scopus subject areas

Access to Document

Other files and links

Fingerprint

Jeremy Bryans

Cite this

Detection of Automotive CAN Cyber-Attacks by Identifying Packet Timing Anomalies in Time Windows

Abstract

Conference

Keywords

ASJC Scopus subject areas

Access to Document

Other files and links

Fingerprint

Profiles

Jeremy Bryans

Cite this