CAN Intrusion Detection via Signal Clustering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Modern vehicles rely on proprietary CAN data mappings, making it difficult to decode and interpret real-time vehicle information without access to these mappings, which hinders research, cybersecurity, and aftermarket tuning.
Innovation Solution
The development of a detection and forensics framework for intrusion detection in CAN buses, which includes a vehicle CAN interface, memory for storing ID traces, and a processor for generating vehicle CAN signal definitions, predicting signal boundaries, and translating CAN data into interpretable signals.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If proprietary CAN data mappings are used by OEMs, then security and data protection are improved, but the ability to decode and interpret CAN data is worsened
Solution Approach 1:
The patent introduces an intermediary system that sits between the proprietary CAN data source and the analysis tools. This intermediary automatically decodes and translates the encoded CAN data into interpretable formats, allowing researchers and security analysts to access meaningful information without having access to the proprietary mappings themselves, thus maintaining security while enabling analysis
Solution Approach 2:
The system creates copies of the decoded signal definitions and stores them in a database. These copies can be used for analysis without exposing the original proprietary mappings. The copied data maintains the necessary information for decoding while being separate from the sensitive source materials
2Loss of information
If reverse engineering of CAN mappings is performed manually, then decoding capability is improved, but time consumption and labor are worsened
Solution Approach 1:
The patent replaces the manual mechanical process of reverse engineering with an automated computational system. The system uses algorithms to automatically analyze CAN data patterns, identify signal boundaries, and generate decoded signal definitions without human intervention, dramatically reducing the time and labor required while maintaining or improving decoding accuracy
Solution Approach 2:
The system performs preliminary automated analysis of CAN data to pre-generate decoded signal definitions and store them in a database. This preliminary action prepares the data in advance for future queries and analysis, eliminating the need for repeated manual reverse engineering efforts on the same data
3Measurement precision
If per-vehicle reverse engineering is performed, then decoding accuracy is improved, but scalability and versatility are worsened
Solution Approach 1:
The patent creates a universal decoding system that can handle multiple vehicle types and proprietary formats through a single automated platform. The system uses general algorithms that adapt to different data patterns, allowing it to decode CAN data from various sources without requiring separate manual reverse engineering processes for each vehicle, thus achieving both accuracy and scalability
Data Source
AI summary
A system and method for intrusion detection on automotive controller area networks. The system and method can detect various CAN attacks, such as attacks that cause unintended acceleration, deactivation of vehicle's brakes, or steering the vehicle. The system and method detects changes in nuanced correlations of CAN timeseries signals and how they cluster together. The system reverse engineers CAN signals and detect masquerade attacks by analyzing timeseries extracted from raw CAN frames. Specifically, anomalies in the CAN data can be detected by computing timeseries clustering similarity using hierarchical clustering on the vehicle's CAN signals and comparing the clustering similarity across CAN captures with and without attacks.