PE-detector: Intrusion Detection of Periodic and Event Message Attacks on Controller Area Networks

Recently, a number of cyber attacks on in-vehicle networks have been reported, with one of the main attack strategies being the masquerade attack, which impersonates other electronic control units (ECU). Subsequently, intrusion detection systems are mainly studied to detect masquerade attack attempts. However, existing research cannot detect certain masquerade attack attempts that use periodic and event messages, ultimately resulting in low detection rates. In this paper, we propose an acceptance filter-based intrusion detection system called PE-detector, which is able to detect a variety of masquerade attack types on the controller area network (CAN) bus including periodic and event message-based masquerade attacks with 100% accuracy when all ECUs are able to receive and transmit CAN messages from the CAN bus. If an arbitrary ECU cannot participate in CAN communications due to a DoS attack, PE-detector cannot detect a masquerade attack impersonating the corresponding node, but it is able to detect abnormal patterns of CAN bus caused by the DoS attack. In addition, since PE-detector is able to be added to the CAN bus as a dongle-type ECU board, no hardware changes to legacy ECUs are required. The proof-of-concept for PE-detector has been validated in a real vehicle.