[Paper Review] CASAD: CAN-Aware Stealthy-Attack Detection for In-Vehicle Networks

Nasser Nowdehi, Wissam Aoudi+2 more|arXiv (Cornell University)|Sep 18, 2019

Vehicular Ad Hoc Networks (VANETs)Engineering31 references20 citations

TL;DR

This paper proposes CASAD, a CAN-aware, system-agnostic intrusion detection system that learns normal IVN traffic behavior from historical data to detect stealthy attacks without relying on vehicle-specific configurations. It achieves prompt detection of previously undetectable stealthy attacks, including the novel 'conquest' attack, with zero false positives across multiple real vehicles and a 2018 Volvo XC60 testbed.

ABSTRACT

Nowadays, vehicles have complex in-vehicle networks (IVNs) with millions of lines of code controlling almost every function in the vehicle including safety-critical functions. It has recently been shown that IVNs are becoming increasingly vulnerable to cyber-attacks capable of taking control of vehicles, thereby threatening the safety of the passengers. Several countermeasures have been proposed in the literature in response to the arising threats, however, hurdle requirements imposed by the industry is hindering their adoption in practice. In particular, detecting attacks on IVNs is challenged by strict resource constraints and utterly complex communication patterns that vary even for vehicles of the same model. In addition, existing solutions suffer from two main drawbacks. First, they depend on the underlying vehicle configuration, and second, they are incapable of detecting certain attacks of a stealthy nature. In this paper, we propose CASAD, a CAN-Aware Stealthy-Attack Detection mechanism that does not abide by the strict specifications predefined for every vehicle model and addresses key real-world deployability challenges. Our fast, lightweight, and system-agnostic approach learns the normal behavior of IVN dynamics from historical data and detects deviations by continuously monitoring IVN traffic. We demonstrate the effectiveness of CASAD by conducting various experiments on a CAN bus prototype, a 2018 Volvo XC60, and publicly available data from two real vehicles. Our approach is experimentally shown to be effective against different attack scenarios, including the prompt detection of stealthy attacks, and has considerable potential applicability to real vehicles.

Motivation & Objective

• Address the critical need for real-time, lightweight, and deployable intrusion detection in in-vehicle networks (IVNs) under strict resource and real-time constraints.
• Overcome the limitations of existing solutions that fail to detect stealthy attacks—especially those that mimic normal behavior and avoid disrupting traffic patterns.
• Develop a system-agnostic detection mechanism that does not require predefined specifications or configurations for individual vehicle models.
• Enable prompt detection of novel stealthy attack variants, such as the 'conquest' attack, which evades traditional anomaly-based detection by preserving normal traffic dynamics.

Proposed method

• CASAD models normal IVN behavior by learning temporal patterns from historical CAN traffic using a lag-based statistical analysis of message inter-arrival times.
• It computes a 'departure score' for each message based on deviation from expected inter-arrival intervals, using a sliding window of size $ L $ and a statistical dimension $ r $.
• The system employs a threshold-based alarm mechanism where the threshold $ heta $ is optimized via validation on a subseries of normal traffic to minimize false positives while ensuring timely detection.
• The method uses a delay factor $ heta_{L, heta} $ to quantify detection latency, with optimal $ L^* $ and $ heta^* $ selected by minimizing the area under the curve (AUC) of detection delay across multiple threshold trials.
• It applies a system-agnostic approach by avoiding reliance on ECU-specific signatures or vehicle model configurations, enabling broad applicability.
• The framework is validated using a CAN bus prototype, a 2018 Volvo XC60, and publicly available data from a 2012 Toyota Corolla and 2012 Honda Civic.

Experimental results

Research questions

• RQ1 Can a system-agnostic, lightweight anomaly detection mechanism detect stealthy attacks on IVNs that do not alter message periodicity or timing patterns?
• RQ2 How can an intrusion detection system be designed to operate effectively under strict resource and real-time constraints in automotive environments?
• RQ3 What is the optimal trade-off between detection delay and false positive rate for detecting stealthy attacks in real-world CAN traffic?
• RQ4 To what extent can a single detection model trained on one vehicle be effectively applied to other vehicle models without reconfiguration?
• RQ5 Can a novel, truly stealthy attack—such as the 'conquest' attack—be detected by a system that relies solely on traffic pattern analysis?

Key findings

• CASAD successfully detected all instances of the novel 'conquest' attack, a truly stealthy attack that does not alter message timing or periodicity, which existing systems fail to detect.
• The system achieved zero false positives across all test scenarios, including normal traffic from a 2018 Volvo XC60, a CAN bus prototype, and two other real vehicles (2012 Toyota Corolla and 2012 Honda Civic).
• The optimal threshold $ heta^* $ was determined through a data-driven validation process that minimized detection delay while maintaining robustness to false alarms.
• The delay factor $ heta_{L, heta} $ was minimized for the optimal lag parameter $ L^* $, demonstrating prompt detection across multiple attack scenarios.
• CASAD demonstrated high generalizability, performing effectively on vehicles of different makes and models without requiring model-specific tuning or configuration.
• The method outperformed existing approaches in detecting stealthy attacks by focusing on subtle deviations in message behavior that are invisible to timing-based detectors.