Skip to main content
Article
COIDS: A Clock Offset based Intrusion Detection System for Controller Area Networks
ACM International Conference Proceeding Series
  • Subir Halder
  • Mauro Conti
  • Sajal K. Das, Missouri University of Science and Technology
Abstract

Controller Area Network (CAN) is an in-vehicle communication protocol which provides an efficient and reliable communication link between Electronic Control Units (ECUs) in real-time. Recent studies have shown that attackers can take remote control of the targeted car by exploiting the vulnerabilities of the CAN protocol. Motivated by this fact, we propose Clock Offset-based Intrusion Detection System (COIDS) to monitor in-vehicle network and detect any intrusion. Precisely, we first measure and then exploit the clock offset of transmitter ECU's clock for fingerprinting ECU. We next leverage the derived fingerprints to construct a baseline of ECU's normal clock behaviour using an active learning technique. Based on the baseline of normal behaviour, we use Cumulative Sum method to detect any abnormal deviation in clock offset. Particularly, if the deviation in clock offset exceeds an unexpected positive or negative value, COIDS declares this change as an intrusion. Further, we use sequential change-point detection technique to determine the exact time of intrusion. We perform exhaustive experiments on real-world publicly available datasets primarily to assess the effectiveness of COIDS against three most potential attacks on CAN, i.e., DoS, impersonation and fuzzy attacks. The results show that COIDS is highly effective in defending all these three attacks. Further, the results show that COIDS considerably faster in detecting intrusion compared to a state-of-the-art solution.

Meeting Name
ACM International Conference
Department(s)
Computer Science
Research Center/Lab(s)
Center for High Performance Computing Research
Comments
National Science Foundation, Grant HIRPO2018040400359
Keywords and Phrases
  • Clock Offset,
  • Clock Skew,
  • Controller Area Network,
  • Cumulative Sum method,
  • Intrusion Detection Systems
International Standard Book Number (ISBN)
978-145037751-5
Document Type
Article - Conference proceedings
Document Version
Citation
File Type
text
Language(s)
English
Rights
© 2020, All rights reserved.
Publication Date
1-1-2020
Publication Date
01 Jan 2020
Disciplines
Citation Information
Subir Halder, Mauro Conti and Sajal K. Das. "COIDS: A Clock Offset based Intrusion Detection System for Controller Area Networks" ACM International Conference Proceeding Series (2020)
Available at: http://works.bepress.com/sajal-das/216/