System and method for detecting malicious can controller behavior from hostile clock control

Abstract

A system comprising: a microcontroller located on a communication bus; a power consumption circuit configured to determine power consumption of the microcontroller, wherein the processor is programmed to: determine whether a clock associated with the microcontroller is suspended and whether average operating power has exceeded a power threshold, and in response to the average operating power exceeding the power threshold and in response to a message identifying an attacked electronic control unit or an attacked message, output an alert associated with an event causing a bit pattern change of a message on the communication bus in response to determining that the microcontroller is under a suspicious attack.

Description

Technical Field

[0001] This disclosure relates to communication protocols such as Controller Area Networks (CAN bus) in vehicle networks, aerospace systems, industrial systems, etc. Background Technology

[0002] The CAN bus can serve as a central communication network in several modern systems, such as automotive, aerospace, and industrial systems. Adding remote interfaces to some nodes on the bus exposes these systems to remote attacks. Several security researchers have repeatedly demonstrated this in the automotive sector. Therefore, improving the security of the CAN bus has become a significant research area over the past decade.

[0003] The original design principles of CAN, along with the computational capabilities of typical nodes on a network, significantly increase the difficulty of integrating security into the network. Several techniques have been proposed in the literature to address this problem using dedicated intrusion detection systems (IDS) in the form of novel key negotiation mechanisms and lightweight authentication schemes. Several of these proposed mechanisms assume that the adversary's actions are restricted to damaging the software on the node, thus providing attackers with opportunities to inject arbitrary... CAN compatible The ability to send CAN-compliant messages. This assumption allows for the optimization of security mechanism design.

[0004] CAN peripherals may allow adversaries to maliciously inject messages incompatible with the CAN protocol using existing software interfaces. This could include the injection or insertion of arbitrary bits into (erroneous) messages. Because such attack vectors are relatively new, they can be difficult to detect, and unknown methods exist for detecting them. Summary of the Invention

[0005] According to one embodiment, a system includes: a microcontroller; and power consumption circuitry configured to determine the power consumption of the microcontroller, wherein the processor is programmed to: determine whether a clock associated with the microcontroller is paused and whether the average operating power has exceeded a power threshold, and in response to the average operating power exceeding the power threshold, to perform a countermeasure against hardware or software associated with an event that causes a change in the average operating power.

[0006] According to one embodiment, a system includes: a microcontroller located on a communication bus having a CAN network; and a processor communicating with the microcontroller. The processor is programmed to: determine a voltage associated with each corresponding bit of each CAN frame; classify nodes using the voltages associated with the corresponding bit and the CAN frame, and record the transmitter associated with the corresponding bit; and, in response to a voltage indication associated with the next bit indicating that it is not associated with the transmitter, output an alert associated with a potential attack on the network.

[0007] According to one embodiment, a system includes: a microcontroller located on a communication bus; and power consumption circuitry configured to determine the power consumption of the microcontroller, wherein the processor is programmed to: determine whether a clock associated with the microcontroller has been paused and whether the average operating power has exceeded a power threshold, and in response to the average operating power exceeding the power threshold and in response to a message identifying an attack or an attacked electronic control unit, and in response to determining that the microcontroller has been subjected to a suspected attack, output an alarm associated with an event that causes a bit pattern change in a message on the communication bus. Attached Figure Description

[0008] Figure 1 An illustrative example of the CAN bus is disclosed.

[0009] Figure 2 Additional interfaces between the CAN controller and the microcontroller have been disclosed.

[0010] Figure 3 This is an illustrative example flowchart of a CAN controller preparing to launch an attack for arbitrary bit insertion.

[0011] Figure 4 This is a diagram illustrating a method for inserting a dominant bit of arbitrary duration via a CAN controller.

[0012] Figure 5 The illustration shows an example of using a shunt resistor to monitor MCU power consumption.

[0013] Figure 6 An illustrative embodiment for monitoring a communication (CAN) bus in order to perform fingerprinting on the ECS on the communication bus is disclosed. Detailed Implementation

[0014] Embodiments of this disclosure are described herein. However, it is to be understood that the disclosed embodiments are merely examples, and other embodiments may take various and alternative forms. The figures are not necessarily to scale; some features may be exaggerated or minimized to show detail of particular components. Therefore, the specific structural and functional details disclosed herein should not be construed as limiting, but merely as a representative basis for teaching those skilled in the art to employ the embodiments in various ways. As will be understood by those skilled in the art, various features illustrated and described with reference to any of the figures may be combined with features illustrated in one or more other figures to produce embodiments not explicitly illustrated or described. The combinations of illustrated features provide representative embodiments for typical applications. However, for a particular application or implementation, various combinations and modifications of features consistent with the teachings of this disclosure may be desired.

[0015] This disclosure describes methods and systems that can be used to detect misuse of a CAN controller as explained below. Consequently, such detection methods and systems may be needed to initiate countermeasures to prevent hostile actions. This disclosure may also provide a method for detecting the transmission of non-CAN compatible messages, which can be used to force nodes on the bus to enter... Bus disconnected (Bus-off) state. Therefore, nodes may be inaccessible to protect against potential threats. Several advantages can be associated with this approach. One advantage is that the method can detect new types of adversaries previously assumed to be impractical for CAN systems. These methods can also be applied to observation points in the network, including nodes remotely attacked and used to send messages on the CAN bus, or more robust central nodes (e.g., gateways). The proposed methods described below can be used in combination to produce more robust detection mechanisms. This approach can be used in a variety of systems utilizing CAN networks, such as vehicle systems, aerospace systems, industrial control systems, building control technologies, etc.

[0016] This disclosure may include security mechanisms to defend against remote software-based attacks on nodes connected to a Controller Area Network (CAN) bus. The system may assume that adversary-inserted attack messages conform to the CAN Data Length Code (DLC) and physical layer specifications, such as those in ISO-11898 / 1 (e.g., or ISO-11898 / 2, ISO-11898 / 3). However, based on some of the proposed attack mechanisms, this assumption is no longer sufficient for some deployed ECUs. The systems and methods described below in this disclosure can be used to detect malicious packets that can be inserted in an incompatible manner and can be used to disable or shut down the ECU.

[0017] Figure 1 This is an illustrative example of a CAN bus. A CAN bus can reside in vehicle networks, aerospace systems, industrial systems, etc. The system may include a microcontroller 101 that operates or controls specific components, while a CAN controller 103 can handle communication processing for one or more microcontrollers 101. In a traditional layered design, it might be assumed that interaction between these layers can occur at the message passing interface. In a traditional CAN stack, the CAN controller can monitor the bus for transmitted packets and ensure that all transmitted messages are compatible with the CAN protocol.

[0018] The CAN controller 103 can accept data payloads and message IDs from the application and send CAN-compatible message frames to the CAN transceiver 105. The CAN transceiver 105 can transmit analog signals on the bus. The CAN controller 103 can ensure that appropriate contention resolution operations occur, such as back-off if arbitration between two simultaneous transmitters is lost, thereby ensuring the transmission of erroneous frames, message ID filtering, and maintaining an appropriate inter-frame spacing (IFS).

[0019] The CAN controller logic can be implemented in hardware. Therefore, it is assumed that an adversary restricted to software manipulation cannot modify the behavior of the CAN controller 103. Therefore, it can be assumed that the messages transmitted on the bus are CAN-compatible.

[0020] In several modern ECUs, the CAN controller 103 and the microcontroller (MCU) 101 are part of the same physical package, thus exposing new interfaces to the MCU, namely clock control and power control. The CAN network can be a two-wire half-duplex high-speed network system. In terms of functionality and reliability, the CAN network can have advantages over other serial technologies (such as RS232), and CAN implementations can also be more cost-effective.

[0021] Figure 2An example embodiment including an additional interface between a CAN controller and a microcontroller is illustrated. In several modern ECUs, the CAN controller 103 and the microcontroller (MCU) 101 are part of the same physical package, thus exposing a new interface to the MCU: clock control and power control. This new interface may (typically) be invisible to the application and is used by low-level device drivers to optimize chip power consumption and power consumption during debugging operations. However, this interface can be exploited by malware to influence the structure of messages transmitted on the bus. As shown, the MCU 101 and CAN controller 103 may include a voltage supply connection 203 maintained from transistor leads, which are typically connected to the supply or to a resistor connected to the supply. Furthermore, modern CAN controller 203 and MCU 201 may have a generated clock signal 201. The clock signal can oscillate between high and low states and is used to coordinate actions in the circuitry. The clock signal can be generated by a clock generator. Based on this new connection, the MCU 101 can utilize the voltage supply connection 203 for various readings on the CAN controller 103. This change can be described below.

[0022] Figure 3This is an illustrative example flowchart illustrating a malicious MCU preparing to launch an attack involving arbitrary bit insertion. As shown, the operations CLKOFF / CLKON (clock off / clock on) can represent actions that disable and enable the peripheral clock (clock gating) to the CAN controller. At step 302, CLK ON can be activated to enable the peripheral clock (clock gating) to the CAN controller. The CAN controller can ensure that appropriate contention resolution operations occur, such as backing up if arbitration between two simultaneous transmitters is lost, thereby ensuring the transmission of erroneous frames, message ID filtering, and maintaining an appropriate inter-frame interval (IFS). At step 303, the MCU can set various settings related to filtering and speed. At step 305, the system can wait for the inter-frame interval. At step 307, the MCU can send a packet with ID 0x00 and payload 0101...0101 to the buffer. This attack could potentially exploit a message with ID 0x00 and an 8-byte payload of 0101...01. At step 309, the MCU can wait for arbitration and DLC transmission. The system may assume that attack messages inserted by an adversary conform to the CAN Data Length Code (DLC) and physical layer specifications, such as those in ISO-11898 / 1 (or, for example, ISO-11898 / 2, ISO-11898 / 3). At step 311, CLK OFF can be activated to disable the peripheral clock (clock gating) to the CAN controller. Therefore, CLK OFF disables the peripheral clock to the CAN controller, thereby suspending the controller state. This can be used to transmit dominant bits.

[0023] Figure 4 This is an illustration of method 400 for inserting dominant bits of arbitrary duration via a CAN controller. Dominant bits (bit 0) can have any length on the CAN bus. As shown, the operations CLKOFF / CLKON can represent disabling and enabling the peripheral clock (clock gating) to the CAN controller. The implementation details of this operation may vary depending on the type of MCU. For example, if using an Arduino Due MCU, it might utilize the low-level command pmc_disable_periph_clk in the SDK. Similarly, the method used to measure the low-level timing for synchronizing actions can vary based on r different MCUs.

[0024] At step 402, the system can wait for the target message. The attack may exploit a message with ID 0x00 and an 8-byte payload of 0101...01. The attack can include two distinct phases. In the first phase, a high-priority message ID is transmitted, causing the CAN controller to enter a state for transmission of that payload. After waiting for the RTR bit to be transmitted, the clock is disabled using the command CLKOFF, thus freezing the controller's state. This prepares the controller to transmit the message. Once the target message is identified, the second attack phase can begin.

[0025] At step 403, the attack phase can be initiated by using the CLKON command to transmit the first dominant bit of the payload. At step 405, the next step may include disabling the peripheral clock of the CAN controller. The controller's dominant state can then be frozen using the CLKOFF command. The disabling of the peripheral clock can last for a desired duration, which can have any type of length. At step 407, once the dominant state has been maintained for the desired duration, the system can transition the controller to a recessive state via a successive CLKON and then via the CLKOFF signal at step 409. Therefore, this mechanism allows the transmission of a single dominant bit of arbitrary duration at a time chosen by the attacker. Controlled pausing and releasing of the CAN controller state machine ensures that it is always ready to transmit the attack bit at step 411.

[0026] Arbitrary insertion of dominant bits can be used to induce various interrupts on the CAN bus. Arbitrary insertion of dominant bits can also be used to disable remote ECUs. This technique can be based on the abuse of the error containment mechanism built into the robustness-enhancing CAN protocol, thereby temporarily causing an interrupt in the target ECU. Bus disconnected This allows the target ECU to temporarily halt data transmission on the bus.

[0027] As part of the CAN protocol, each ECU maintains an error counter. Whenever a transmission error or reception error occurs, the Transmission Error Counter (TEC) and Receive Error Counter (REC) are incremented. The ECU's transmission behavior depends on the values ​​of these counters. When the error counter value of a node exceeds a predetermined threshold, indicating that the ECU has caused too many errors, that ECU will remove itself from the bus (isolate from the bus) to prevent interruption of normal bus operation. Bus disconnected It remains offline for a predetermined interval, during which it can then be reset to a good state.

[0028] During message transmission, each ECU can read the message bits written to it on the bus. In the event of a difference in bit polarity between the write and read bits, the CAN protocol specifies that the ECU can assume the difference is due to an error and immediately transmit an error flag. Simultaneously, it increments the error counter (TEC) by 8. Subsequently, each successful message transmission decrements the TEC by 1. Once the error counter reaches 255, the ECU enters a state of emergency. Bus disconnected state.

[0029] An adversary capable of inserting dominant bits at any time could overwrite selective recessive bits in messages transmitted by the target ECU, leading to errors and ultimately causing problems within the target ECU. Bus disconnected State. Because the message payload is typically random and determined by the transmitter, it can be difficult to predict the location of the recessive bits that need to be targeted. Therefore, in the absence of any bus feedback (as in a scenario targeting a software attacker), the attacker will have to target known recessive bits that are typically present in the CAN control field of the message. This gives the attacker a high probability of targeting the same bit or a small group of bits in each target ECU message.

[0030] Because attackers can use clock control to launch attacks, the start and stop times of the attack will be synchronized with the transmitted bits. Furthermore, to avoid unnecessary interruptions, the attacker may target only a single recessive bit and the following error flag during each attack period. Therefore, the attack duration will span a fixed number of CAN bits, and the start and stop times will be synchronized with the bit transmission.

[0031] Since an attacker wants to cause a bus disconnect, it needs to induce errors in the target node at a sufficiently high rate, causing the TEC to reach 255 without recovery. This will typically cause the adversary to target either consecutive messages aimed at the target node or the majority of messages transmitted by the node.

[0032] One method of attack could exploit software-defined clock gating control on the MCU to transmit dominant bits for arbitrary durations. Furthermore, the attack could induce malicious activity by using bit insertion to shut down a critical ECU. This could then be used to launch further attacks in response to the shutdown of an ECU (e.g., a critical ECU). Independent of the final attack target, the initial steps required in a CAN network are clock control targeting the ECU and the ECU shutdown. Several countermeasures can be designed to detect the occurrence of one or both of these conditions via both local and remote nodes.

[0033] One mechanism used to detect clock control targeting and shutdown of the ECU can include power analysis-based detection. A key requirement for attacking a CAN controller is the ability to arbitrarily disable the clock and suspend the CAN controller's state during message transmission. Typically, this clock control mechanism is designed in the MCU to reduce power consumption by disabling the clocks of unused peripherals. Therefore, any hostile attempt to disable the clock to the CAN controller will have a measurable impact on the power drawn by the MCU package. Circuitry capable of measuring the power drawn by the MCU package can be used to monitor this deviation and detect potential CAN attacks.

[0034] The detection mechanism can perform this power analysis, which will be present on any ECU that might be targeted by a remote adversary and requires several components. The first component could be circuitry for measuring the power consumption of the MCU package. The time resolution (sampling frequency) and voltage resolution (sensitivity) may need to be sufficient to detect changes caused by the CAN controller. In an illustrative embodiment, a sampling rate of 500 MSamp / s may be sufficient for a typical MCU operating at 100 MHz. For a CPU operating at 5V, a 16-bit voltage resolution, i.e., a resolution of 100 uV, may also be efficient.

[0035] This system may require multiple profiles for different operating states in the circuit or MCU. Therefore, it may be advantageous to store a set of power profiles characterizing the power consumption of the MCU (or circuit) for different active states. These profiles could consist of templates that can be used for comparison during real-world operation of the chip. Alternatively, this could consist of artificial neural networks, such as multilayer perceptrons (MLPs) or long short-term memory (LSTM) networks, trained using time-series voltage data from regular chip operation. These profiles should additionally characterize the effects of power changes (on / off) on different peripherals. They can be trained to identify correct (or, malicious) operations under different environmental conditions (e.g., different temperatures, different tasks, etc.). Alternatively, the function that determines whether a trace corresponds to normal or malicious behavior can accept additional information that allows it to perform different classifications based on external parameters such as temperature, humidity, etc.

[0036] The system may also require a processor that can utilize power measurements and compare them to a stored power profile to classify the current measurement as malicious or valid. This processor can execute an algorithm that utilizes several thresholds depending on the number of possible valid and invalid power levels in the MCU. In the case of an artificial neural network, where the profile takes the form of a neural network, the output of the neural network could be a binary classification (either malicious or valid) of the time-series voltage data from the bus.

[0037] Figure 5 An example of using a shunt resistor to monitor MCU power consumption is illustrated. In this embodiment, an exemplary circuit 500 can be used, which includes a shunt resistor 507 inserted in series with the power line. To measure the voltage across the shunt resistor 507, this design can utilize a high resolution (e.g., a resolution similar to the embodiments explained above, including (in one non-limiting embodiment) an ADC with 500 MSamps at 16-bit resolution). The ADC 505 is connected to a processor 503 with a sampling rate at least several times the bit rate of CAN transmission. It should be noted that the ADC 505 and the (auxiliary) processor 503 power source should be adequately isolated from the MCU power so that the observations do not affect the MCU power profile.

[0038] To classify the measurement results, an algorithm stored on (or accessed by) processor 503 can use one or more thresholds to determine whether the clock to the controller is paused. However, a barrier using a single static threshold may result in a high false positive rate. Therefore, it may be necessary to define the threshold as a percentage of the average operating power at any given time instance. Furthermore, the algorithm should identify changing periodic patterns and correlate them with potential attack scenarios.

[0039] For example, an algorithm can be used to classify the measurement results. This algorithm can assume that the processor is aware of the CAN bit rate (e.g., defining the length of the CAN bit as Tc). Furthermore, it can be assumed that the relative threshold τ has been calculated based on experimental analysis.

[0040] The processor has a sequence v(t) of voltage measurements at different time samples. If τ L ≤| v ( t +1)− v ( t )|≤ τ HThe algorithm then defines potential malicious intent. potentially malicious event e ( i )= t ,in t It is the time value of the voltage observation, and τ L , τ H The threshold is obtained from the power profile. This event definition can be used with circuits employing shunt resistors (such as...). Figure 5 The voltage measurement results obtained in the embodiments depicted herein. In alternative implementations, the triggering conditions for such an event may need to be adjusted in response to circuit dynamics or MCU operation. For example, the triggering conditions may be adjusted based on the number of applications operating. For example, in embodiments where the measurement is performed using current measurements at MCU pins or by detecting electromagnetic radiation from the processor, the triggering conditions may be based on differences in the drawn current and EM intensity, respectively.

[0041] In one embodiment, the event is triggered whenever a change in voltage exceeds a certain threshold. However, this can lead to a high false trigger rate in most real-world scenarios. For added robustness, these events can instead be defined as... e ( i )=( t, {+ / For example, a timestamp with a symbol indicating whether the event was caused by an increase or decrease in voltage. In this setup, if the event is triggered by an increase in voltage, the immediately following event must be a decrease event, and vice versa. This can be based on the fact that controller disable and enable operations must occur alternately. Therefore, all registered events that do not have this pattern may be discarded as spurious events.

[0042] Then, the adversary might measure the time difference between consecutive events and check whether that time difference is a multiple of the CAN bit duration, i.e. e ( i +1)− e ( i )≈ kT c For integers k This uses the fact that, for a successful attack, the adversary's actions will be synchronized with the CAN bit, and for a reliable implementation, it should target that bit approximately simultaneously. If events meet this criterion, they can be marked as inherently hostile.

[0043] In noisy environments where multiple spurious events may exist, the standard of this algorithm can be modified to... e ( i + j )− e ( i )≈ kT c , j ∈[1 ,N a ],in N a It is a neighborhood determined experimentally based on the probability of false alarms based on events. This criterion assumes the existence of high-frequency false events, which may be the case in a typical noisy automotive environment.

[0044] Adversarial detectors (e.g., detection circuits) can utilize the number of times a target event occurs within a given duration and compare it to a threshold tolerable for error-free operation. Typically, executing an attack within a short duration may be advantageous for the successful application of a considered attack technique. Therefore, the high frequency of such events can trigger the detector to flag the presence of an adversary.

[0045] For adversaries willing to extend their attacks across multiple messages, the comparison duration and threshold can be adjusted based on the number of messages typically transmitted on the bus. For example, for a bus where messages are periodic and 100 messages are transmitted within a 1-second duration, to target an ECU with a 125ms period, the adversary would need to transmit at least one attack message per second. Therefore, 2-3 events per second might indicate hostile activity. Thus, the threshold could be adjusted to 2-3 message transmissions per second.

[0046] In scenarios where power profiles are represented by neural networks, network structures with memory (such as recurrent neural networks (RNNs)) can implicitly handle the temporal relationships between various events. Therefore, such network structures are suitable for power-based detection. A simple RNN-based binary classifier can be trained using operational data to identify malicious events.

[0047] In another embodiment, a different detection mechanism using remote monitoring can be utilized. In this scenario, an enhanced intrusion detection system operating on the ECU can be used instead of a circuit. Typically, some IDS solutions operating at the application layer act on received message frames and may not notice error messages because error messages are not relayed to the application layer. Therefore, detection of shutdown-type attacks exploiting error messages, as described here, is not possible. The system can include detection methods that can be integrated into such a software IDS solution. However, what is required is that the CAN controller used on the ECU running the IDS has certain capabilities. One capability could be the ability to issue an interrupt (or set a flag) when an error message (or an equivalent measurement of an error counter) is received. Another capability could be to issue an interrupt (or set a flag) when the start of frame (SoF) is received. Another capability of the system (e.g., circuitry) could be the ability to issue an interrupt (or set a flag) when a frame has been successfully received in the buffer (e.g., when a previous frame transmission has completed). Another capability of the system could be the ability to receive an arbitration ID associated with the error message. Many controllers have this capability or at least a subset of this capability. Based on the capabilities available in the controller, the system can extend existing IDS rules to detect adversaries.

[0048] This approach may further require the IDS system to maintain a list of successfully received messages (IDs and payloads) without violating existing IDS rules. The scope and size of this list can be optimized based on available resources.

[0049] There may be scenarios where the arbitration ID associated with the error message is unavailable. In the presence of an IDS solution, an adversary must execute the attack without violating existing IDS rules, such as rules regarding the frequency of non-flooding messages and periodic messages. Therefore, if the target node enters a bus-off mode and stops transmitting due to this attack, the adversary must insert a message with the expected message ID to compensate for the target node's absence from transmission. Thus, by observing the message ID immediately following the error, the message can be used as an indicator of the target message ID. To identify such a target message, the network IDS system can perform the following steps:

[0050] In the first step, when the first... i Error flags E f ( i When this flag appears, the system can track a list of message IDs that immediately follow it. L i ={ ID i1 ID i 2 ,...,ID i k The condition is... ID i j The priority should be higher than ID i j +1 This indicates a list of potential IDs that may have caused an error and could be potential targets of the adversary.

[0051] In the second step, for consecutive errors, the system can find a common ID among the consecutive errors, i.e. R = L i ∩ L i+1 ∩ ...L m Next, the assembly. R The ID in the database is likely to be attacked. It should be noted that adjustments can be made. m The value of , such as the number of errors considered, is used to ensure that attack identification is more accurate. With m The increase, R The size should be made smaller and converge to 1 in the event of a real attack (or a faulty transceiver).

[0052] In the third step, R The final ID that exists in (e.g., ID R This could be considered faulty or compromised. To determine which of these two scenarios is correct, the IDS system can examine the message history to check the origin of the message during transmission. ID R Check if other messages from the ECU are faulty. If the error is caused by an ECU malfunction, there is a high probability that other messages from the same ECU are also faulty. If not, the system can conclude with high confidence that the ID has been attacked.

[0053] If the adversary is aware of the IDS method, it may attempt to evade the aforementioned detection by performing the following actions.

[0054] Between two attacks on a specific target, the adversary might target a random ID. In this case, the considered intersection (as explained in step two above) will fail because consecutive errors may not have the same ID.

[0055] An adversary may attack multiple IDs from the same ECU. This, along with a violation of the intersection as explained in step two, will also cause the IDS to consider the ECU faulty.

[0056] In the first scenario, we can consider { L i ,L i+1 ,L i+m This problem is mitigated by using the intersection of arbitrary subsets of a subset of the IDS, rather than the intersection of consecutive subsets. Where the IDS is computationally unrestricted, a set of all possible subsets can be considered. However, in practice, several subsets can be randomly selected and tested. This random selection ensures that an adversary cannot use a fixed error pattern to evade IDS detection.

[0057] The second scenario is slightly more challenging. In this scenario, because multiple IDs are targeted at the same ECU, finding the attacked message ID using the methods described here will be difficult. Therefore, for this scenario, the IDS should need to map the message ID to the ECU that made the transmission, and should use the ECU to track the transmission, rather than using the ID, i.e., having... L i ={ ECU i 1 ECU i 2 ,...,ECU i k A list of} instead of L i ={ ID i 1 ID i 2 ,...,ID i k A list of}, where ID i 1 Depend on ECU i 1 This is transmitted. This helps the IDS identify potential target ECUs, rather than message IDs. Based on a CAN bus architecture, the mapping between ECUs and message IDs can be easily defined within the IDS.

[0058] Next, since multiple messages from the same ECU may be targeted, the method for distinguishing between genuine faults and hostile actions based on the mechanism in step three becomes impossible. Instead, the IDS identifies hostile messages based on the location of the error. For example, due to a lack of feedback, the adversary can typically only target recessive bits that it might easily predict (i.e., static or control fields). However, errors caused by problems in the transmitter are unlikely to be limited to such fields. Therefore, if the adversary observes an error pattern only in the static field, it can conclude with high probability that a hostile entity is present.

[0059] Because the error frame is discarded by the CAN controller, there is no direct method for observing the field or bit that caused the error in a software-only IDS. Instead, the IDS can estimate the field by observing the time difference between the start of the frame and the error flag. This time can be obtained by measuring the time difference between the SoF flag and the error flag using a local high-resolution counter. It should be noted that this difference will also include the time of the stuff bit, which is a priori unknown to the IDS. Unless an attacker makes the node vulnerable... Bus disconnected The state is determined by the target node; otherwise, the target node will retransmit the message. This retransmission can be used to calculate padding bits and the target segment and bits. This forces the node into a state by targeting multiple retransmitted messages from the target node. Bus disconnected In the case of the retransmission mode, this retransmission cannot be used to obtain the fill bit count because an adversary may transmit arbitrary messages during the retransmission. However, provided that the frequency rules in the IDS are not violated, a rapid increase in the receive error counter can be used as an indication of adversarial action.

[0060] Additionally, it is assumed that a consistent bit pattern exists before the error occurs. b 1 ,b 2 ,...,b e For example, the two dominant bits preceding the error. In this scenario, the IDS system can check if this pattern, which wouldn't cause an error, existed earlier in the error message (or other messages from the same ECU). If so, it can be concluded with a high probability that the error is the result of a hostile action. Similar checks on padding bits can be performed on a retransmitted message basis.

[0061] Once a message or ECU has been identified as under attack with a high probability, the IDS can deploy decoy frames to measure the hostile response. This assumes the target message ID has a periodicity. T This cycle T If a tolerance Δ is present, then IDS performs the following.

[0062] IDS selects random time instances to deploy decoy frames.

[0063] IDS waits for the transmission of the message ID and records it.

[0064] The IDS disables the error retransmission flag / bit in the CAN controller. This ensures that the IDS will not retransmit the frame in the event of an error.

[0065] In time T At point −Δ, after observing the message ID, the IDS replays the recorded message and monitors the frame for errors.

[0066] In the case where this transmission resulted in an error, it can be concluded that the error was a result of hostile actions.

[0067] The decoy frame attempts to simulate the real transmitter frame at the expected time. An adversary with only software access cannot determine whether the frame is being transmitted as a decoy or by the real ECU without full observation of it. Therefore, it has a high probability of targeting the decoy frame. In scenarios where the adversary does not target consecutive frames, multiple decoy frames can be deployed to ensure a high probability of being targeted by the adversary.

[0068] In scenarios where the arbitration ID associated with the error message is unavailable, the system can utilize other types of countermeasures against hostile attacks (e.g., those related to clock control). For example, the method described above can be modified to identify hostile actions when the arbitration ID associated with the error message becomes available to the IDS software. Since the message ID is available, the IDS can directly identify potential target nodes. Therefore, the system may need to classify whether the error is caused by an ECU malfunction or a hostile error (e.g., such as an attack).

[0069] For each ECU on the CAN bus, the IDS can maintain a shadowed TEC (Transmission Error Counter), which is adjusted based on observations of error frames and message IDs. Various actions can be taken based on this TEC. For example, if the TEC for a tracked ECU reaches 255 (e.g., a bus disconnection condition), the system can check for frequency violations in the IDS rule set for message IDs originating from the target node. If no such violation is detected, an adversary may be impersonating a bus disconnection node. Therefore, the system can be programmed to mark message IDs and the presence of the target node.

[0070] If the TEC is insufficient to trigger a bus disconnect condition (as described above in the previous paragraphs), the IDS can use the steps outlined above to flag hostile activity. The IDS can examine various interactions within the system. For example, the system can check if a message ID from a specific ECU caused an error. The system can also check if other messages from the same ECU also caused errors. If they did not, the system is highly likely to be programmed to assume these errors were caused by hostile actions, and therefore countermeasures can be implemented and message IDs and nodes flagged.

[0071] The system can also observe the bit and / or field that caused the error. If an error for a given message ID repeatedly occurs in fields or locations in other messages from the ECU that are not erroneous, the system can be programmed with high confidence that the error is caused by a hostile action.

[0072] The system can also be configured to identify message IDs or ECUs that have been attacked. Once a message ID or ECU has been identified as attacked with a high probability, the decoy frame technique described above can be used as a potential countermeasure. Of course, other countermeasures can also be utilized.

[0073] In alternative embodiments, some systems can record analog CAN signals and perform accurate identification of the transmitter based on observed signal characteristics. CAN fingerprinting methods can rely on differences in CAN transceiver characteristics and propagation network properties between different nodes.

[0074] Figure 6 An illustrative embodiment for monitoring a communication (CAN) bus to fingerprint the ECS on the communication bus is disclosed. This technique typically requires direct access to the CAN bus 611, using high-performance circuitry capable of digitizing and recording CAN signals. Figure 6The diagram illustrates an example of this configuration using a high-resolution ADC. The CAN bus may include two dedicated wires for communication: CAN high 612 and CAN low 610. When the CAN bus is in idle mode, these two wires may carry the same voltage (e.g., 2.5V). When data bits are being transmitted, the CAN high wire may increase to a different voltage (e.g., 3.75V), and the CAN low wire may decrease to a lower voltage (e.g., 1.25V). Therefore, a voltage differential (e.g., 2.5V differential) may exist. The communication may rely on the voltage differential between the two bus wires. Multiple characteristics of the signal, such as voltage, timing, or edge transients, are extracted and used to differentiate and identify transmission nodes among multiple ECUs. Measurements from the differential probe 609 of the CAN fingerprinting circuit 603 can be utilized. Typically, this approach is part of a CAN network intrusion detection system (IDS) 603 to identify potential malicious transmitters of frames based on observations of complete CAN frames. This system can be modified to detect the shutdown attacks described here based on malicious error frames.

[0075] The proposed method leverages the property that an adversary must overwrite the recessive bits of a target node with dominant bits to induce an erroneous frame. This system could consider a CAN fingerprinting method (e.g., utilizing CAN fingerprinting circuit 603), which uses configuration (such as...) Figure 6 This is used to record signal properties in order to create a template of characteristics for each transmission node. This profile is processed on the unit attached to the observation circuit.

[0076] Processor 605 (e.g., the processor in CAN fingerprinting circuit 603) can be programmed to observe and store the voltage corresponding to the bits of each CAN frame. j The first frame in the frame i The sequence of unit digit measurement results can be represented as b ji The differential probe 609 can be used to plot these measurement results. The processor 605 can assume that the classifier C takes the sequence of bit voltage measurement results as input and outputs the identifier of the transmission node, such as C(b ji )= N ,in N This represents a node on the network. Such a classifier can be obtained through several methods.

[0077] For observed error frames, a method can be determined to detect whether they were triggered by malicious activity. The system can then consider error frames as... r Bit length (including error flags), andl It is the index of the last dominant bit, and k It makes k and l All bits between them are the dominant minimum index. Such a set of bits can represent error flags, dominant transmissions made by nodes, and dominant bits inserted by adversaries to cause error flags.

[0078] In a hostile scenario, all nodes on the bus, except the transmitter, will transmit the error flag after the transmitter's error flag violates the padding condition. Therefore, the last 6 bits of the observed frame (i.e., l -5 ,...,l It consists of error flags transmitted by other nodes and does not generate information about the adversary.

[0079] Consider using bit 1 ,...,k -1 Identify transmission nodes based on classification. N For each bit i , k ≤ i ≤ l -6, Use a classifier to identify bit b i That is, calculate C(b) i ).

[0080] make i 0 is what makes C(b) i0 ) 6 = N The minimum index. Record. b i0 The transmitter (e.g.) N 0) is used for future reference to the adversary. This represents a potential candidate for a bit inserted by the adversary.

[0081] Calculate the transmission node for the next bit, i.e., C(b). i0+1 This should be the starting point for error flags sent by the transmitter on the bus. If C(b) i0+1 ) 6 = N If the value is 0, then this indicates that the error bit caused by the error is malicious.

[0082] If stored due to an earlier message frame observed on the bus N If the existing value is 0, the stored sender (a potential adversary from the previous frame) is compared with the current value (a potential adversary from the current frame). If the values ​​match, the error is highly likely due to adversarial action.

[0083] The method described above can be used to identify the presence of bits transmitted by nodes different from the scheduled transmitter (such as adversaries). For each erroneous frame, the confidence level in correctly identifying the adversary can depend on the accuracy of the classifier C(·). For current systems used in practice, the accuracy of the classifier may be limited to less than 90%. Therefore, for most practical scenarios, a single erroneous frame will be insufficient to accurately identify the presence of an adversary. Instead, the described system can utilize multiple erroneous frames. Since adversaries typically use the same nodes to launch attacks, identifying a single malicious transmitter with multiple erroneous frames can indicate malicious activity with a high probability.

[0084] The processes, methods, or algorithms disclosed herein may be deliverable to / implemented by a processing device, controller, or computer, which may include any existing programmable electronic control unit or dedicated electronic control unit. Similarly, these processes, methods, or algorithms may be stored in a variety of forms as data and instructions executable by a controller or computer, including but not limited to information permanently stored on non-writable storage media (such as ROM devices) and information alternatively stored on writable storage media (such as floppy disks, magnetic tapes, CDs, RAM devices, and other magnetic and optical media). These processes, methods, or algorithms may also be implemented in a software executable object. Alternatively, these processes, methods, or algorithms may be embodied, in whole or in part, using suitable hardware components (such as application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), state machines, controllers, or other hardware components or devices), or a combination of hardware, software, and firmware components.

[0085] While exemplary embodiments have been described above, these embodiments are not intended to describe all possible forms included in the claims. The language used in this specification is descriptive and not restrictive, and it is to be understood that various changes may be made without departing from the spirit and scope of this disclosure. As previously described, features of various embodiments may be combined to form further embodiments of the invention that may not be explicitly described or illustrated. While various embodiments may have been described as providing advantages over other embodiments or prior art implementations in one or more desired characteristics, or being preferred over other embodiments or prior art implementations, those skilled in the art will recognize that trade-offs can be made to one or more features or characteristics to achieve desired overall system properties, depending on the specific application and implementation. These properties may include, but are not limited to: cost, strength, durability, lifecycle cost, marketability, appearance, packaging, size, maintainability, weight, manufacturability, ease of assembly, etc. Therefore, any embodiment described to some extent as less desirable than other embodiments or prior art implementations in one or more characteristics is not outside the scope of this disclosure and may be desirable for a particular application.

Claims

1. A system comprising: A microcontroller on a communication bus with a CAN (Controller Area Network) network; A power consumption circuit is configured to: determine the voltage associated with each corresponding bit of at least one CAN frame, and determine the average operating power consumption of the microcontroller based on the voltage associated with each corresponding bit; The processor is programmed to determine whether the clock associated with the microcontroller is paused and, when the clock is paused, to determine whether the average operating power consumption has exceeded a power threshold. as well as The processor is further programmed to: If the average operating power consumption exceeds the power threshold, the system is determined to be under attack; and In response to determining that the system has been attacked, an alarm is output that is associated with an event that causes a change in the average operating power consumption.

2. The system according to claim 1, wherein the power threshold is a dynamic threshold.

3. The system of claim 1, wherein the power threshold is associated with a certain percentage of the average operating power consumption at any time instance.

4. The system of claim 1, wherein the processor is further programmed to receive one or more power profiles from a set of power profiles, wherein the power profiles indicate the power consumption of the microcontroller for various operating states.

5. The system of claim 4, wherein the processor communicates with a machine learning network trained using time-series voltage data.

6. The system of claim 4, wherein the one or more power profiles include information indicating the impact of power variations on different peripheral devices.

7. The system of claim 1, wherein the system includes a shunt resistor, and wherein the processor is programmed to measure the voltage across the shunt resistor.

8. The system of claim 1, wherein the processor is further programmed to identify periodic patterns in the power threshold.

9. The system of claim 1, wherein the alarm includes bits transmitted on the communication bus.

10. The system of claim 1, wherein the power threshold is responsive to an external parameter including at least temperature information or humidity information.

Images