CAN Bus Message Timing Detection for Injection Anomalies
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Controller Area Network (CAN) buses are vulnerable to malicious messages injected into periodic traffic, causing devices to perform false operations due to the inability to distinguish between legitimate and illegitimate messages with matching IDs.
Innovation Solution
A method involving a controller connected to the CAN bus that compares the time differences between received messages to detect anomalies, setting a limit of two-thirds the message period to differentiate between legitimate and illegitimate messages, thereby preventing false operations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If devices accept all messages with matching CAN ID, then message reception is simple and fast, but devices cannot distinguish malicious injected messages from legitimate periodic messages
Solution Approach 1:
The system pre-calculates and stores the expected time difference (limit) between periodic messages before operation. This preliminary preparation allows the device to quickly compare actual message arrival times against the pre-established threshold without complex real-time calculations, enabling reliable malicious message detection while maintaining simple real-time operation.
Solution Approach 2:
The detection mechanism uses the inherent periodicity property of legitimate messages themselves to identify anomalies. By monitoring the time intervals between consecutive messages with the same CAN ID and comparing against the expected period, the system enables each device to self-detect malicious injections without requiring external authentication services or complex verification protocols.
2Measurement precision
If the detection limit is set to the exact message period, then legitimate periodic messages are accurately identified, but false positives occur due to non-deterministic jitter in message timing
Solution Approach 1:
The system applies a localized tolerance threshold (limit = 2/3 of period) specifically designed to accommodate the known characteristics of message jitter. Rather than using a single universal threshold, the limit is locally optimized based on the periodic message properties and expected jitter range, allowing accurate distinction between legitimate timing variations and malicious injections while minimizing false positives.
Solution Approach 2:
The detection limit parameter is changed from the exact message period to two-thirds of the period. This parameter adjustment creates a detection window that is tolerant of normal timing jitter (allowing messages slightly earlier than expected) while still detecting malicious messages that arrive too soon. The modified parameter balances measurement precision with reliability in the presence of non-deterministic variations.
3Reliability
If the system detects and blocks messages with time difference less than the limit, then malicious messages are prevented, but legitimate messages with slight timing variations may be incorrectly blocked
Solution Approach 1:
The system applies partial detection by using a threshold (2/3 of period) that is less than the full period, creating a detection zone that covers the most critical malicious injection scenarios while allowing legitimate timing variations. This partial action approach detects the majority of malicious messages while tolerating normal jitter, avoiding excessive blocking of legitimate traffic.
Data Source
AI summary
A method and system for detecting illegitimate messages injected into legitimate messages of a bus, such as a Controller Area Network (CAN) bus, are provided. Legitimate messages are broadcasted over the bus with a period whereby the legitimate messages are periodic legitimate messages. A controller connected to the bus receives at a first time instant a first message from the bus and receives at a second time instant a second message from the bus. The controller compares a first difference in time between the second time instant and the first time instant with a limit. The limit is two-thirds of the period. An anomaly is detected when the first difference in time is less than the limit.