DAGA: Detecting Attacks to In-Vehicle Networks via N-Gram Analysis

Recent research showcased several cyber-attacks against unmodified licensed vehicles, demonstrating the vulnerability of their internal networks. Many solutions have already been proposed by industry and academia, aiming to detect and prevent cyber-attacks targeting in-vehicle networks. The majority...

Full description

Saved in:
Bibliographic Details
Published in:IEEE transactions on vehicular technology 2022-11, Vol.71 (11), p.11540-11554
Main Authors: Stabili, Dario, Ferretti, Luca, Andreolini, Mauro, Marchetti, Mirco
Format: Article
Language:English
Subjects:
Algorithms
Anomalies
Automobiles
Automotive electronics
Automotive engineering
computer security
Constraints
controller area network
Cybersecurity
embedded software
Hardware
In vehicle
intrusion detection
Messages
Microcontrollers
Networks
Payloads
Proposals
Protocols
road vehicles
Security
Citations: Items that this one cites
Items that cite this one
Online Access:Get full text
Tags: Add Tag
No Tags, Be the first to tag this record!
Description
Summary:Recent research showcased several cyber-attacks against unmodified licensed vehicles, demonstrating the vulnerability of their internal networks. Many solutions have already been proposed by industry and academia, aiming to detect and prevent cyber-attacks targeting in-vehicle networks. The majority of these proposals borrow security algorithms and techniques from the classical ICT domain, and in many cases they do not consider the inherent limitations of legacy automotive protocols and resource-constrained microcontrollers. This paper proposes DAGA , an anomaly detection algorithm for in-vehicle networks exploiting n-gram analysis. DAGA only uses sequences of CAN message IDs for the definition of the n-grams used in the detection process, without requiring the content of the payload or other CAN message fields. The DAGA framework allows the creation of detection models characterized by different memory footprints, allowing their deployment on microcontrollers with different hardware constraints. Experimental results based on three prototype implementations of DAGA showcase the trade off between hardware requirements and detection performance. DAGA outperforms the state-of-the-art detectors on the most performing microcontrollers, and can execute with lower performance on simple microcontrollers that cannot support the vast majority of IDS approaches proposed in literature. As additional contributions, we publicly release the full dataset and our reference DAGA implementations.
ISSN:0018-9545
1939-9359
DOI:10.1109/TVT.2022.3190721