Vehicle CAN-Bus Timing Analysis for ECU Masquerade Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current intrusion-detection systems in vehicle CAN-bus networks lack the ability to identify the source of cyber attacks, particularly in scenarios like masquerade attacks, due to the absence of a MAC address and the reproducibility of time drifts between ECUs.
Innovation Solution
Implement a method and device that analyze message traffic by grouping periodic messages, calculating average and accumulated clock offsets, and using linear regression to identify unique clock skews for each ECU, enabling accurate identification of message transmitters through correlation analysis and anomaly detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If time drift analysis is used to identify message sources in CAN-bus networks, then message authentication capability is improved, but reliability deteriorates due to reproducibility of time drifts between ECUs
Solution Approach 1:
The patent segments the time drift analysis into two independent components: average clock offset (identifying the ECU of origin) and clock skew (identifying the specific transmitter). By separating these functions, the system can reliably authenticate messages even when ECUs have reproducible time drift patterns, as each ECU's unique combination of average offset and skew serves as a distinctive fingerprint.
2Measurement precision
If MAC addresses are implemented in CAN-bus nodes, then attacker recognition capability is improved, but device complexity increases
Solution Approach 1:
The patent implements self-service by enabling ECUs to automatically generate their unique time-based fingerprints (average clock offset and clock skew) without external configuration or additional hardware identifiers. Each ECU's inherent clock characteristics serve as its natural identification mechanism, eliminating the need for MAC addresses or other complex addressing infrastructure while providing reliable attacker recognition.
3Reliability
If clock skew analysis is performed for each message, then transmission security is improved, but processing time increases
Solution Approach 1:
The patent applies preliminary action by pre-calculating and storing the average clock offset and clock skew characteristics for each ECU during a learning phase before normal operation. During actual message transmission, the system only needs to compare incoming messages against these pre-established fingerprints, dramatically reducing processing time while maintaining high security. This avoids the need for complex real-time clock skew analysis of each individual message.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Described herein is a method for protection from cyber attacks in a communication network, in particular a CAN (Controller Area Network), of a vehicle, the network comprising: a communication bus (10), in particular a CAN-bus, and a plurality of nodes (11) associated to said communication bus (10) in a signal-exchange relationship and associated at least in part to control units for controlling functions of the vehicle, said nodes (11) exchanging messages (M) passing between nodes of said plurality of nodes (11), and said messages (M) being identified by respective message identifiers (ID), said method comprising, at a control node (20) associated to said communication bus (10): selecting, from among the messages (M) exchanged between the nodes, periodic messages having a transmission periodicity, grouping (200) said periodic messages into respective groups according to the respective period (Ti), and performing a procedure (300) of analysis of messages of the nodes (11) that exchange said received periodic messages, which comprises, for each group of transmission periodicity: obtaining times of arrival (ai) at the respective nodes (11) of a set of periodic messages that have the same message identifier (ID), computing (312) as a function of said arrival times (ai) average-offset values (Oavg) over successive subsets, of a given number (N) of messages, of said set of received messages, accumulating (314) said average-offset values (Oavg) for each identifier (ID) with respect to each successive subset to obtain accumulated-offset values (Oacc[k]) for each successive subset and a respective identifier (ID), identifying (316) linear parameters (e[k], S[k]) by computing a regression over said accumulated-offset values (Oacc[k]) for each successive subset and respective identifier (ID), said computation comprising computing an angular coefficient, or slope, of the regression, and an intercept, or identification error, computing (318), on the basis of average-offset values (Oavg) obtained at the step of computing (312) as a function of said arrival times (ai) average-offset values (Oavg) over successive subsets, a correlation coefficient (p) of the average offset (Oavg) of pairs of messages identified as coming from one and the same node, performing a first check (350) to check whether the correlation coefficient (p) is higher than a first given threshold, performing a second check (330) to check whether the angular coefficient (S[k]) between two consecutive messages with the same identifier is higher than a second given threshold, performing a third check (340) to check whether the intercept (e[k]) between two consecutive messages is higher than a third given threshold, and supplying the results of said first check (350), said second check (330), and said third check (340) to a message-classification operation (360), configured to supply (RC) a confirmation of classification of the messages according to the transmitting node (11) and message identifier (ID) or an indication of classification error as a function of said results.