The Controller Area Network (CAN) protocol is the most widely used standard for in-vehicle networks. However, the CAN protocol lacks essential security features (e.g., encryption) which makes it vulnerable to exploits by an adversary. In this paper, we develop CANLP, a Natural La
...
The Controller Area Network (CAN) protocol is the most widely used standard for in-vehicle networks. However, the CAN protocol lacks essential security features (e.g., encryption) which makes it vulnerable to exploits by an adversary. In this paper, we develop CANLP, a Natural Language Processing (NLP)-based intrusion detection system to find whether a transmitted message originated from a legitimate ECU or an adversary. CANLP uses the Term Frequency-Inverse Document Frequency (TF-IDF) to discern complex features associated with CAN data and trains ML models with these features to identify fuzzing, spoofing, and masquerade attacks. When an attack is detected, CANLP identifies the specific ECU on which the attack was mounted on. Through extensive experiments on four public vehicle network datasets, we show that CANLP performs attack classification with high F1-score of 0.9974. We also demonstrate using a testbed that CANLP can be deployed for attack detection on resource-constrained hardware a latency of < 0.05 ms.
@en