Vehicle CAN-Bus Voltage Fingerprinting for Cyberattack Source Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing intrusion-detection systems in vehicle CAN-bus networks fail to recognize the source of cyber attacks effectively, leading to inefficiencies in identifying and mitigating malicious messages, particularly in scenarios like masquerade attacks.
Innovation Solution
A method utilizing neural networks to analyze physical voltage levels of the CAN-bus, extracting statistical features from dominant bits, and employing supervised learning to identify the source of malicious messages by distinguishing between internal and external attackers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional intrusion-detection systems are used to monitor CAN-bus messages, then the presence of cyber attacks can be detected, but the source of the attacks cannot be identified
Solution Approach 1:
The patent applies electrical signal analysis to detect subtle variations in voltage levels during dominant bit transmission. By monitoring the electrical characteristics (voltage levels, rise/fall times) of CAN bus signals, the system creates an electrical 'fingerprint' for each node, enabling identification of the attacker's physical location rather than just detecting that an attack is occurring.
Solution Approach 2:
The patent replaces traditional message-content-based analysis with physical-layer electrical signal analysis. Instead of examining the logical content of CAN messages, the system measures electrical parameters (voltage levels, signal timing) to identify the physical source of malicious transmissions, substituting mechanical/electrical measurement for logical content analysis.
2Measurement precision
If message content analysis is used to identify malicious nodes, then the source can be tracked, but false positives increase due to masquerade attacks
Solution Approach 1:
The patent introduces an intermediary measurement layer between message transmission and attack detection. By measuring electrical characteristics of the physical signal rather than directly analyzing message content, the system creates an intermediate identification method that is independent of message manipulation, thereby reducing false positives from masquerade attacks.
Solution Approach 2:
The patent changes the detection parameter from logical message content to physical electrical characteristics. By monitoring voltage levels, signal timing, and electrical impedance during dominant bit transmission, the system identifies attackers based on their electrical fingerprint rather than their message content, making the detection immune to masquerade attacks that copy legitimate message patterns.
3Measurement precision
If comprehensive monitoring of all CAN-bus nodes is implemented, then accurate attacker identification is achieved, but system complexity increases
Solution Approach 1:
The patent implements self-service by having each node's electrical characteristics automatically measured and stored during normal operation. The monitoring system passively captures voltage levels and signal timing during regular CAN bus communication without requiring active probing or additional hardware at each node, enabling automatic creation of electrical fingerprints for all nodes.
Solution Approach 2:
The patent creates a universal monitoring approach where the same electrical measurement technique applies to all CAN-bus nodes regardless of their function or message content. The system uses a single set of measurement principles (voltage level detection during dominant bits) to identify any attacker on the bus, making the solution universally applicable across different vehicle systems and attack scenarios.
Data Source
Figure 1
Figure 2A~2B
Figure 3
AI summary
Described herein is a method for protection from cyber attacks in a communication network, in particular a CAN (Controller Area Network), of a vehicle, that comprises a bus (10), in particular a CAN-bus, comprising a high bus line (10H), on which high logic voltages pass, and a low bus line, on which low logic voltages pass (10L), and a plurality of nodes (11) associated to said bus (10) in a signal-exchange relationship and associated at least in part to control units for controlling functions of the vehicle, said nodes (11) exchanging messages (M) passing between nodes of said plurality of nodes (11) to identify illicit messages (MF), said messages (M) being coded in data frames through dominant and recessive bits, said method comprising: a step (110) of building sets of dominant voltage measurements for each message identifier (ID) associated to a message (M) that is passing; a step (120) of extracting statistical features (fi), in particular features accumulated in respective sets (SMi) of dominant voltage measurements (NVi,k) for each message identifier (IDi); supplying (130) the statistical features (fi) for each message identifier (IDi) that are available at each instant (tIdi) at input to a neural network (30) of a pattern-recognition type; carrying out an operation (140) of classification, or pattern recognition, supplying a prediction (yp) of a membership class corresponding to a given node (111, ..., 11n) on the basis of at least said statistical features (fi) supplied at input; carrying out (150) an anomaly-detection operation that comprises evaluating whether said prediction (yp) supplied by the neural network (30) corresponds to a given node (11p) that allows as admissible message identifier (IDa) the message identifier at input (IDi) and, if it does not, signalling (FLG) an anomaly for said message identifier (IDi); and carrying out an operation (160) for recognition of attacks, which comprises evaluating whether a number of anomalies signalled for said message identifier exceeds a given threshold (m).