SaTC: CORE: Small: Collaborative: GOALI: Detecting and Reconstructing Network Anomalies and Intrusions in Heavy Duty Vehicles

重型车辆（如卡车和公共汽车）是美国和全球物流的重要组成部分，通常携带高价值或高风险的货物（如爆炸性液体和气体）。重型车辆通常有数百个电子控制单元（ecu），它们通过内部网络进行通信，以执行命令（如“刹车”）或共享传感器数据（如装载石油的加压货物单元的温度）。接入通信网络的ecu可以发送他们想要的任何消息。如果网络或ECU受到攻击，卡车或货物集装箱的安全机制可能会发生故障。该项目从卡车上收集数据，以更好地了解重型车辆组件之间的通信，并开发在这种环境下检测攻击的技术。该项目致力于实现三个主要目标：(1)从运行中的重型车辆收集具有代表性的控制器区域网络（CAN）总线数据，(2)开发能够区分异常CAN总线网络流量的检测系统，以及(3)测试和验证检测系统以减少误报的数量。该团队正在开发一种对数代数，以有效地评估使用有限资源的嵌入式设备的实时CAN流量。在高速公路运行期间，从卡车交通中收集数据，使机器学习算法能够用于异常检测。该团队正在评估其入侵检测技术在重型车辆测试平台上的有效性，对测试平台ecu和真实CAN流量数据进行综合攻击。

Heavy vehicles (e.g., trucks and busses) are a critical element of U.S. and worldwide logistics, often carrying cargo of high value or high risk (e.g., explosive liquids and gasses). Heavy vehicles often have hundreds of Electronic Control Units (ECUs) that communicate over an internal network to carry commands (such as "engage the brakes") or share sensor data (such as the temperature of pressurized cargo unit carrying petroleum). ECUs with access to the communication network can send any message they want. If the network or an ECU is compromised by an attack, the truck or a cargo container safety mechanism could malfunction. This project is gathering data from operational trucks to better understand communication among components of heavy vehicles and developing techniques to detect attacks in this environment.The project is working to accomplish three main objectives: (1) Collect representative Controller Area Network (CAN) bus data from operational heavy vehicles, (2) Develop detection systems that can distinguish anomalous CAN bus network traffic, and (3) Test and verify the detection systems to reduce the number of false positives. The team is developing a log algebra to efficiently assess live CAN traffic using embedded devices with limited resources. Data is being gathered from truck traffic during highway operation, enabling the application of machine learning algorithms for anomaly detection. The team is evaluating the effectiveness of their intrusion detection techniques in their heavy vehicle testbed, using synthetic attacks against testbed ECUs and real-world CAN traffic data.