[Paper Review] Network intrusion detection systems for in-vehicle network - Technical report

Guillaume Dupont, Jerry den Hartog+2 more|arXiv (Cornell University)|May 28, 2019

Vehicular Ad Hoc Networks (VANETs)48 references4 citations

TL;DR

This technical report provides a comprehensive, categorized inventory of network intrusion detection systems (NIDS) for in-vehicle CAN bus networks, analyzing how each system extracts information (CAN ID, payload, timing) and builds detection models (specified or learned). The key contribution is a systematic classification of 24 CAN NIDS proposals based on data usage and modeling approach, highlighting challenges in model construction and the trade-offs between accuracy and practical deployment.

ABSTRACT

Modern vehicles are complex safety critical cyber physical systems, that are connected to the outside world, with all security implications that brings. To enhance vehicle security several network intrusion detection systems (NIDS) have been proposed for the CAN bus, the predominant type of in-vehicle network. The in-vehicle CAN bus, however, is a challenging place to do intrusion detection as messages provide very little information; interpreting them requires specific knowledge about the implementation that is not readily available. In this technical report we collect how existing solutions address this challenge by providing an organized inventory of various CAN NIDSs present in the literature, categorizing them based on what information they extract from the network and how they build their model.

Motivation & Objective

• To systematically organize and categorize existing network intrusion detection systems (NIDS) for in-vehicle CAN bus networks.
• To identify and analyze the different types of information used by CAN NIDS—such as CAN ID, payload, and timing—across the literature.
• To examine how detection models are constructed, distinguishing between manually specified models and learned models from traffic observation.
• To highlight challenges in model accuracy, including false positives due to incomplete learning phases and lack of access to vendor specifications.
• To lay the groundwork for future benchmarking by identifying gaps in evaluation and the need for a unifying testing framework.

Proposed method

• Categorizing CAN NIDS based on the type of data they analyze: single frames, consecutive frames, or windowed frame sequences.
• Classifying model construction methods into 'specified' (based on vendor documentation) and 'learned' (built from observed traffic during a learning phase).
• Analyzing detection techniques that focus on CAN ID for identifying malicious frames, such as in fuzzing attacks.
• Evaluating payload-based detection using deep packet inspection techniques to identify abnormal or unexpected values in CAN message payloads.
• Assessing timing-based detection that monitors message regularity and periodicity to detect anomalies in message flow.
• Surveying response mechanisms such as message blocking via dominant bit injection or triggering 'limp mode' to disable non-essential systems during attacks.

Experimental results

Research questions

• RQ1 How do existing CAN NIDS differ in the type of data they use for intrusion detection—CAN ID, payload, or timing?
• RQ2 What are the relative strengths and limitations of specified versus learned models in CAN NIDS for real-world deployment?
• RQ3 How do different NIDS handle the challenge of false positives, especially when the learning phase fails to capture full operational variability?
• RQ4 What are the practical implications of relying on undocumented or proprietary CAN message semantics for detection?
• RQ5 What response mechanisms are proposed in the literature, and how do they balance security with safety-critical system availability?

Key findings

• The majority of CAN NIDS rely on learning-based models due to the inaccessibility of official specifications, increasing the risk of false positives if the learning phase is incomplete.
• Payload-based detection is effective for identifying abnormal values but requires deep packet inspection and is sensitive to protocol-specific semantics.
• CAN ID-based detection is commonly used for identifying known malicious patterns, such as those from fuzzing attacks, but is limited to single-frame analysis.
• Timing-based detection is effective for identifying irregular message flows, especially when messages are expected to be periodic.
• Only a few systems propose practical response mechanisms, such as injecting error frames or triggering 'limp mode', to mitigate detected attacks.
• The survey identifies a critical gap in standardized evaluation, with no unified framework for comparing NIDS performance across different vehicles or attack scenarios.