Voltage-based automotive can bus illegal access and intrusion detection method

Abstract

The application provides a voltage-based CAN illegal access and intrusion detection method, which can realize end-to-end intrusion identification without analyzing message IDs. The application can simultaneously collect characteristics from differential pairs and different positions on the same line, not only using more extensive voltage characteristics from the same point, but also mining voltage differences between different collection points. Through this double strategy, the system can detect even the slightest change in the CAN network, thereby significantly improving the granularity and accuracy of intrusion detection. Compared with traditional methods, the present method not only improves the detection ability of passive attacks, but also enhances the defense effect of active attacks, thereby providing a more robust security solution for vehicle-mounted networks.

Description

Technical Field

[0001] This invention belongs to the field of electrical communication technology, specifically relating to a voltage-based method for detecting unauthorized access and intrusion into an automotive CAN bus. Background Technology

[0002] In modern vehicles, the CAN network enables Electronic Control Units (ECUs) to process sensor data and control critical functions such as steering, acceleration, and lighting. The reliability of the CAN bus is crucial, as its integrity is directly related to the overall safety of the vehicle. However, because the CAN network was initially designed for efficiency rather than security, its transmitted messages lack both verification and encryption mechanisms, leaving it vulnerable. This vulnerability allows attackers to intercept and tamper with messages, compromising the confidentiality, integrity, and availability of the in-vehicle communication system. Researchers have successfully implemented and demonstrated various cyberattacks exploiting CAN network vulnerabilities.

[0003] In the exploration of improving vehicle security, existing technologies mainly focus on introducing encryption and authentication mechanisms into the CAN protocol and developing intrusion detection systems (IDS). These methods aim to defend against overt threats, but often struggle to detect passive attacks—attacks that do not actively damage the system but instead obtain information through unauthorized eavesdropping, posing serious risks to privacy and data security. CAN-LOC mitigates this problem to some extent by utilizing physical side channels to detect silent intrusions in the CAN bus. However, this method still has limitations: it requires a high sampling rate, lacks real-time response capabilities, and relies on parsing message IDs, thus increasing computational overhead. Summary of the Invention

[0004] To address the aforementioned issues, this invention proposes a voltage-based CAN illegal access and intrusion detection method, enabling end-to-end intrusion identification without parsing message IDs. This invention models the intrusion detection problem as a long-sequence multi-class classification task, achieved by synchronously acquiring voltage signals from both ends of the ECU. Experimental results on the constructed intrusion dataset demonstrate that the proposed method achieves a 91% location accuracy in identifying intrusion points, validating its effectiveness and robustness in practical applications.

[0005] To achieve the above objectives, the technical solution of the present invention is as follows:

[0006] A voltage-based method for detecting unauthorized access and intrusion to an automotive CAN bus includes the following steps:

[0007] Step 1, Data Collection

[0008] The voltage signals at two different locations on the CAN bus are synchronously and continuously sampled at high frequency. The voltage signals are recorded on the two communication lines CANH and CANL on both sides of the ECU connection point to obtain the left signals H1 and L1 and the right signals H2 and L2. The differential voltage signal D1 is calculated, D1=H1−L1.

[0009] Step 2, Data Preprocessing

[0010] A data frame segmentation algorithm is used to automatically identify frame boundaries in a continuously acquired differential voltage signal sequence;

[0011] Step 3: Build and train the intrusion detection model.

[0012] The FEDformer model was used as the intrusion detection model, and the model was trained until it converged.

[0013] Step 4, Intrusion Detection and Location

[0014] The frames segmented in step 2 are input into the trained intrusion detection model to identify whether unauthorized or malicious ECUs exist. When a physical intrusion is detected, the model can output information related to the intrusion location.

[0015] Furthermore, the data frame segmentation algorithm includes the following process: setting the length and step size of the sliding window, scanning the entire differential voltage signal sequence in a step manner, and determining that the window is located in the effective area of ​​the data frame when more than a set proportion of sampling points in a certain window satisfy D1>0. The leftmost sampling point in the first window that meets the condition is marked as the rising edge of the frame. Continue sliding along the signal sequence until a frame end marker is detected in the subsequent window. The rightmost sampling point in the last window that meets the condition is marked as the falling edge of the frame.

[0016] Furthermore, the frame end marker changes the D1 value to a preset value.

[0017] Furthermore, the input to the model is a voltage signal sequence with a dimension of N×5, where N represents the number of sampling points in a single frame, and the five feature channels correspond to H1, L1, H2, L2, and D1, respectively.

[0018] The beneficial effects of this invention are as follows:

[0019] 1. This invention proposes a novel feature extraction method capable of simultaneously acquiring features from differential line pairs and different locations on the same line. It not only utilizes a wider range of voltage features from the same point but also mines voltage differences between different acquisition points. Through this dual strategy, the system can detect even extremely minute changes in the CAN network, significantly improving the granularity and accuracy of intrusion detection. Compared to traditional methods, this method not only enhances the detection capability of passive attacks but also strengthens the defense against active attacks, thus providing a more robust security solution for automotive networks.

[0020] 2. The method of this invention can achieve end-to-end intrusion identification without parsing message IDs. By directly analyzing voltage feature signatures, this invention reduces computational overhead and improves detection efficiency, making it highly suitable for real-time security applications in vehicular networks.

[0021] 3. To address the challenges of long sequence modeling, this invention introduces and improves the FEDformer architecture, significantly enhancing its performance in capturing global dynamic features and achieving accurate location recognition. Attached Figure Description

[0022] Figure 1 A schematic diagram of the voltage-based automotive CAN bus illegal access and intrusion detection method provided by the present invention.

[0023] Figure 2 This describes the steps of a data frame segmentation algorithm based on a sliding window.

[0024] Figure 3 A schematic diagram of the model for this invention.

[0025] Figure 4 This is a photograph of the experimental equipment used in this invention.

[0026] Figure 5 This is a schematic diagram illustrating a scenario for detecting unauthorized access and intrusion points on an automotive CAN bus. Detailed Implementation

[0027] The technical solutions provided by the present invention will be described in detail below with reference to specific embodiments. It should be understood that the following specific embodiments are only used to illustrate the present invention and are not intended to limit the scope of the present invention.

[0028] This invention designs an end-to-end intrusion detection and localization framework. This framework utilizes dual-point voltage sampling and deep learning-based analysis to take advantage of the minute electrical changes introduced when an unauthorized ECU accesses the bus. By acquiring signals at two spatially separated sampling points, the system can capture the vertical (between CANH and CANL) differential and the horizontal (across sampling points) propagation differences, thus providing a richer and more sensitive feature space than traditional single-point monitoring.

[0029] The voltage-based method for detecting unauthorized access and intrusion into an automotive CAN bus provided by this invention has the following overall process: Figure 1 As shown, it includes the following steps:

[0030] Step 1, Data Collection

[0031] First, a dual-point oscilloscope module was used to synchronously and continuously sample the voltage signals at two different locations on the CAN bus at high frequency to capture the electrical characteristics exhibited by each ECU during data transmission. Since each ECU contains a uniquely assigned identifier (ID) in its transmitted data frames, the ECU sending the frame could be accurately identified by parsing the ID field of each frame. Subsequently, voltage signals were recorded on the two communication lines (CANH and CANL) on both sides of the ECU connection point, generating four raw signal channels: CANH1, CANL1, CANH2, and CANL2. This yielded the voltage signals of each ECU at both ends of the CAN bus.

[0032] Since CAN frames are transmitted as continuous signals, accurate segmentation of individual frames requires detecting the rising and falling edges of the voltage signal in each frame. This allows for the extraction of the complete frame structure, providing high-quality training samples for subsequent intrusion detection and localization models. Specifically, for ECU_i, let the voltage signals collected along the CANH and CANL lines to the left of its physical connection point be denoted as H1 and L1, respectively, and the signals to the right be denoted as H2 and L2, respectively. We define the differential voltage signal as D1 = H1 − L1, which serves as an indicator of signal transition. By monitoring the dynamic changes of D1, frame boundaries can be effectively identified: when the device is idle (silent), D1 ≤ 0; when transmission begins, D1 > 0; when D1 shows a step increase close to 3.0, it is considered a marker indicating the end of the frame.

[0033] Step 2, Data Preprocessing

[0034] The acquired raw signals then enter the data cleaning stage, where noise and irrelevant interference are filtered out.

[0035] Subsequently, the frame segmentation module isolates individual CAN frames to align voltage features with protocol layer semantics. Based on the feature extraction method in step one, this invention designs and implements a sliding window-based data frame segmentation algorithm. This algorithm can automatically identify frame boundaries in continuously acquired differential voltage signal sequences, such as... Figure 2As shown, the sliding window is set to a length l = 1000 and a step size s = 50, and scans the entire D1 sequence in a stepwise manner. Specifically, when more than 70% (this percentage can be adjusted as needed) of the sampling points within a certain window satisfy D1 > 0, the system determines that the window is located in the valid region of the data frame. At this time, the leftmost sampling point in the first window that meets the condition is marked as the rising edge of the frame. Subsequently, the algorithm continues to slide along the signal sequence until a frame end marker is detected in a subsequent window (i.e., the D1 value jumps to approximately 3.0). At this time, the rightmost sampling point in the last window that meets the condition is marked as the falling edge of the frame. By utilizing the local statistical properties of the sliding window, this method significantly improves the stability and accuracy of frame segmentation, thereby providing a reliable data foundation for subsequent intrusion detection tasks.

[0036] Step 3: Build and train the intrusion detection model.

[0037] On a CAN bus, any change in network topology will affect all electrical signals transmitted through the bus. This is because adding an ECU alters the overall load characteristics and electrical parameters of the system, causing synchronous changes in the voltage signals observed at all ECU terminals. Based on this characteristic, we believe that the voltage signal carried by a single CAN frame, regardless of its sender, contains sufficient information to characterize the topology change. Therefore, by analyzing the voltage signal sequence within a single data frame, topology changes can be effectively detected and identified.

[0038] Accordingly, this invention models the task as a typical long-sequence classification problem, the goal of which is to predict the category label corresponding to a given voltage signal sequence. Specifically, the CANH and CANL voltage signals collected from both sides of any ECU will be used as the model input. If no physical intrusion is detected, the model outputs label 0, indicating a normal state; otherwise, the model outputs an identifier to correspond to the detected intrusion location.

[0039] This invention uses FEDformer, an extension of the Transformer model, as the backbone of the architecture and features a customized design for efficient classification of voltage signal sequences, ultimately achieving accurate detection and location of intrusion behavior on the CAN bus.

[0040] Specifically, the model's input is a voltage signal sequence of dimension N×5, where N represents the number of sampling points in a single frame. The five feature channels correspond to the voltage signals H1, L1, H2, and L2 measured on both sides of the ECU, and the calculated differential signal D1. For example... Figure 3As shown, the input sequence first passes through the data embedding layer of the FEDformer model, where initial feature mapping and high-dimensional representation learning are completed. The embedded sequence is then fed into the FEDformer Encoder Module, which effectively captures complex temporal dependencies and global patterns in the signal. The encoder output then passes through the GELU (Gaussian Error Linear Unit) activation function and Dropout regularization, and is subsequently flattened into a one-dimensional feature vector. Finally, this vector is input into the fully connected classification layer, which maps the learned global temporal representation to a fixed class label.

[0041] set up This represents the set of potential intrusion insertion points on the CAN bus. Each output class of the classifier corresponds to a specific location in this set. During the construction of the training dataset, for each potential insertion point... Voltage signal sequences are collected within a predefined time window. Each captured transmission data sequence within a time window is labeled with its corresponding insertion point p, serving as a supervised learning sample. During data preprocessing, to ensure class balance and representativeness, we first count the number of transmissions for each ECU in each category. Then, we select 100 frames from the ECU with the most transmissions as valid samples. All collected samples are then divided into training and test sets in an 80:20 ratio for model training and performance evaluation, respectively. During model training, we use the RAdam optimizer to improve convergence stability, with an initial learning rate of 0.001. The objective function uses categorical cross-entropy loss to optimize the model's classification performance across different invasion location categories.

[0042] Step 4, Intrusion Detection and Location

[0043] The frames segmented in step two are then input into the trained intrusion detection model, which can identify the presence of unauthorized or malicious ECUs (e.g., ECU_bad). Furthermore, based on waveform distortion observed at dual sampling points, the physical location of malicious node access can be estimated.

[0044] The present invention also provides a voltage-based automotive CAN bus unauthorized access and intrusion detection software system, including a computer program for implementing the voltage-based automotive CAN bus unauthorized access and intrusion detection method provided by the present invention.

[0045] like Figure 4 As shown in Figure a, we developed a VDIA prototype system based on a Raspberry Pi 4B and MCP2515. The Raspberry Pi 4B serves as a microcomputer motherboard, employing an ARM architecture design. The MCP2515 is an independent CAN protocol controller, conforming to the CAN V2.0B technical specification. It connects seamlessly to the microcontroller unit (MCU) via an industry-standard Serial Peripheral Interface (SPI), achieving seamless integration and communication. Figure 4 As shown in Figure b, we used an oscilloscope to sample the voltage signal in the VDIA system during the experiment. The MSO5104 digital oscilloscope used was equipped with RIGOL's advanced UltraVision II technology, with a real-time sampling rate of up to 4GSa / s (4 billion samples per second). Furthermore, it provides powerful capabilities for triggering and decoding various serial protocols.

[0046] Our prototype system simulates normal vehicle driving and assistance functions transmitted via CAN bus communication. The system utilizes a Raspberry Pi and an MCP2515 for simulation. Furthermore, we used a four-channel MSO5104 oscilloscope to acquire voltage signals, including four serial data streams acquired from two different points on the differential bus, such as... Figure 5 As shown, two sampling points are located at opposite ends of the bus.

[0047] We simulated various scenarios, detailed in Table 1, where N represents the node that was maliciously accessed. Scene 0 represents a clean CAN bus state, where there are no malicious connections in the network and all nodes are operating legitimately. The other scenarios involve the presence of malicious nodes, demonstrating the various possibilities of that node eavesdropping in different locations. In both legitimate and malicious scenarios, we collected a large amount of voltage data from each ECU to characterize its specific state under different conditions, and then used this data to train and validate our model.

[0048] Table 1

[0049]

[0050] During the data acquisition phase, each captured data frame contains approximately 4,500 sampling points. To reduce computational complexity while preserving key features of each message, we extract the first 1,500 sampling points from each frame as effective input features. Therefore, the sequence length is set to N=1,500 during both model training and testing phases.

[0051] We evaluated the performance of VDIA and other comparative methods using sampling rate and accuracy, and the results are shown in Table 2.

[0052] Table 2

[0053]

[0054] The results show that even at lower sampling rates, our proposed VDIA can detect and locate malicious access nodes with higher accuracy, demonstrating superior performance while reducing costs. Notably, our method can identify and locate the accessed node using only a single message transmitted by any ECU. In contrast, CAN-LOC requires a series of messages from multiple ECUs in the network to confirm the presence of unauthorized access. This means that our method can provide a more timely response to unauthorized access attempts.

[0055] In the intrusion location identification experiment, the method proposed in this invention achieved a positioning accuracy of 91%, demonstrating its powerful ability to detect and accurately locate intrusions.

[0056] It should be noted that the above content merely illustrates the technical concept of the present invention and should not be construed as limiting the scope of protection of the present invention. For those skilled in the art, various improvements and modifications can be made without departing from the principle of the present invention, and all such improvements and modifications fall within the scope of protection of the claims of the present invention.

Claims

1. A voltage-based method for detecting unauthorized access and intrusion into an automotive CAN bus, characterized in that, Includes the following steps: Step 1, Data Collection The voltage signals at two different locations on the CAN bus are synchronously and continuously sampled at high frequency. The voltage signals are recorded on the two communication lines CANH and CANL on both sides of the ECU connection point to obtain the left signals H1 and L1 and the right signals H2 and L2. The differential voltage signal D1 is calculated, D1=H1−L1. Step 2, Data Preprocessing A data frame segmentation algorithm is used to automatically identify frame boundaries in a continuously acquired differential voltage signal sequence; Step 3: Build and train the intrusion detection model. A neural network model was used as the intrusion detection model, and the model was trained until it converged. Step 4, Intrusion Detection and Location The frames segmented in step 2 are input into the trained intrusion detection model to identify whether unauthorized or malicious ECUs exist. When a physical intrusion is detected, the model can output information related to the intrusion location.

2. The voltage-based method for detecting unauthorized access and intrusion into an automotive CAN bus according to claim 1, characterized in that, The data frame segmentation algorithm includes the following process: setting the length and step size of the sliding window, scanning the entire differential voltage signal sequence in a step manner, and determining that the window is located in the effective area of ​​the data frame when more than a set proportion of sampling points in a certain window satisfy D1>0. The leftmost sampling point in the first window that meets the condition is marked as the rising edge of the frame. Continue sliding along the signal sequence until the end of the frame is detected in the subsequent window. The rightmost sampling point in the last window that meets the condition is marked as the falling edge of the frame.

3. The voltage-based method for detecting unauthorized access and intrusion into an automotive CAN bus according to claim 2, characterized in that, The data frame segmentation algorithm includes the following process: the frame end marker D1 value jumps to a preset value.

4. The voltage-based method for detecting unauthorized access and intrusion into an automotive CAN bus according to claim 1, characterized in that, The input to the model is a voltage signal sequence with dimensions N×5, where N represents the number of sampling points in a single frame, and the five feature channels correspond to H1, L1, H2, L2, and D1, respectively.

Images