[Paper Review] Exploiting the Shape of CAN Data for In-Vehicle Intrusion Detection

Zachariah Tyree, Robert A. Bridges+2 more|arXiv (Cornell University)|Aug 28, 2018

Vehicular Ad Hoc Networks (VANETs)17 references4 citations

TL;DR

This paper proposes a data-driven, vehicle-agnostic intrusion detection system (IDS) for in-vehicle CAN networks by exploiting the geometric shape of CAN data through manifold learning. It introduces two real-time detectors—one based on distance from a learned low-dimensional manifold and another on temporal discontinuities in manifold increments—demonstrating strong detection of ECU-authentic attacks in proof-of-concept tests, with the second detector showing clear, actionable signals even under high-speed traffic.

ABSTRACT

Modern vehicles rely on scores of electronic control units (ECUs) broadcasting messages over a few controller area networks (CANs). Bereft of security features, in-vehicle CANs are exposed to cyber manipulation and multiple researches have proved viable, life-threatening cyber attacks. Complicating the issue, CAN messages lack a common mapping of functions to commands, so packets are observable but not easily decipherable. We present a transformational approach to CAN IDS that exploits the geometric properties of CAN data to inform two novel detectors--one based on distance from a learned, lower dimensional manifold and the other on discontinuities of the manifold over time. Proof-of-concept tests are presented by implementing a potential attack approach on a driving vehicle. The initial results suggest that (1) the first detector requires additional refinement but does hold promise; (2) the second detector gives a clear, strong indicator of the attack; and (3) the algorithms keep pace with high-speed CAN messages. As our approach is data-driven it provides a vehicle-agnostic IDS that eliminates the need to reverse engineer CAN messages and can be ported to an after-market plugin.

Motivation & Objective

• To develop a vehicle-agnostic intrusion detection system (IDS) for CAN networks that does not require reverse engineering CAN message semantics.
• To address the challenge of detecting sophisticated, ECU-authentic attacks where malicious messages originate from legitimate ECUs at correct times.
• To enable after-market deployment of IDS solutions without hardware modifications or vehicle-specific configuration.
• To leverage the intrinsic geometric structure of CAN data to detect anomalies based on deviations in signal manifold shape.
• To ensure real-time performance suitable for high-speed CAN bus traffic.

Proposed method

• Use spectral co-clustering to group correlated CAN signals based on driving states from ambient (normal) traffic data.
• Apply diffusion mapping to learn a low-dimensional, time-evolving manifold representation of CAN data for each driving state.
• Maintain an online, adaptive manifold model using an update formula that allows the manifold to evolve with changing vehicle states.
• Develop a first detector that computes the Euclidean distance from each new CAN message to the learned manifold to detect deviations.
• Develop a second detector that computes the increment distance between consecutive points on the manifold to detect abrupt changes or discontinuities.
• Apply both detectors in real time, ensuring computational efficiency to keep pace with CAN message rates (milliseconds).

Experimental results

Research questions

• RQ1 Can the geometric shape of CAN data be leveraged to detect anomalies without prior knowledge of message semantics?
• RQ2 Can a manifold-based representation of CAN traffic detect ECU-authentic attacks that evade traditional rule-based and frequency-based IDS?
• RQ3 Can the proposed detectors operate in real time on high-speed CAN bus data?
• RQ4 How effective is the increment distance detector in identifying attack intervals despite potential noise or non-representative training data?
• RQ5 Can the method be deployed as an after-market, vehicle-agnostic IDS without reverse engineering?

Key findings

• The increment distance detector produced a clear, strong signal during attack intervals, indicating high sensitivity to anomalous behavior.
• The distance-from-manifold detector showed promise but required refinement, as it sometimes registered lower distances during attacks due to insufficiently representative training data.
• Both detectors operated in real time, keeping pace with high-speed CAN traffic, confirming computational feasibility.
• The second detector successfully identified attack onset and termination as distinct plateaus in the increment distance, suggesting robustness to ECU-authentic attacks.
• The method demonstrated potential for detecting next-generation attacks where malicious data is sent from legitimate ECUs at correct times.
• The approach is inherently vehicle-agnostic and does not require knowledge of CAN-to-function mappings, enabling after-market deployment.