SIMPLE: single-frame based physical layer identification for intrusion detection and prevention on in-vehicle networks
SIMPLE: single-frame based physical layer identification for intrusion detection and prevention on in-vehicle networks
复制标题
DOI：
10.1145/3359789.3359834
复制
发表时间：
2019-12
期刊：
影响因子：
--
通讯作者：
M. Foruhandeh;Yanmao Man;Ryan M. Gerdes;Ming Li;Thidapat Chantem
中科院分区：
文献类型：
--
作者：
M. Foruhandeh;Yanmao Man;Ryan M. Gerdes;Ming Li;Thidapat Chantem
控制器区域网络（CAN）是汽车行业常用的总线标准，用于连接车内的电子控制单元（ECU）。该协议的广播性质，以及缺乏对帧的验证或强大的完整性保证，使得任意数据注入/修改和假冒 ECU 成为可能。虽然已经提出了应对这些攻击的缓解策略，但高昂的实施成本或违反向后兼容性的问题阻碍了这些策略的部署。在这项工作中，我们首先研究了最先进的 CAN 入侵检测和识别系统的不足之处（这些系统依赖于多个帧来检测不当行为并将其归因于特定的 ECU），并证明它们容易受到爬山式攻击。然后，我们提出了利用电子控制单元物理层特征的实时入侵检测和识别系统 SIMPLE，它不仅能利用单帧检测到攻击，还能有效抵消攻击。SIMPLE 的计算成本和数据采集成本都很低，其功效已通过使用汽车级 CAN 收发器的实验室实验和车载实验得到证实，平均错误率分别接近 0% 和 0.8985%。
The Controller Area Network (CAN) is a bus standard commonly used in the automotive industry for connecting Electronic Control Units (ECUs) within a vehicle. The broadcast nature of this protocol, along with the lack of authentication or strong integrity guarantees for frames, allows for arbitrary data injection/modification and impersonation of the ECUs. While mitigation strategies have been proposed to counter these attacks, high implementation costs or violation of backward compatibility hinder their deployment. In this work, we first examine the shortcomings of state-of-the-art CAN intrusion detection and identification systems that rely on multiple frames to detect misbehavior and attribute it to a particular ECU, and show that they are vulnerable to a Hill-Climbing-style attack. Then we propose SIMPLE, a real-time intrusion detection and identification system that exploits physical layer features of ECUs, which would not only allow an attack to be detected using a single frame but also be effectively nullified. SIMPLE has low computational and data acquisition costs, and its efficacy is demonstrated by both in-lab experiments with automotive-grade CAN transceivers as well as in-vehicle experiments, where average equal error rates of close to 0% and 0.8985% are achieved, respectively.