Abnormal Message Detection for CAN Bus Based on Message Transmission Behaviors

Electronic control units and actuators in a modern vehicle communicate with each other through controller area network (CAN) bus to ensure driving safety. Current methods assume that time interval or frequency of a normal message always keeps constant and detect abnormal messages by checking whether a message's time interval or frequency changes. However, through real CAN bus dataset analysis, we find that time interval and frequency of a normal message may change greatly in different vehicle driving conditions (such as Acceleration, Deceleration, and Driving mode shift), which can cause low detection accuracy of current methods. To handle this problem, in this paper, we propose a message transmission behavior based abnormal message detection system (MetraDS), which detects abnormal messages in CAN bus based on message transmission behaviors including frequency and message sequence. Through real dataset analysis, we find that a message's sequence usually does not change in different vehicle driving conditions, and also an abnormal message affects the frequency of itself and its subsequent messages. Accordingly, MetraDS checks message sequence dissimilarity to determine whether abnormal messages exist in a message sequence and then checks each message's influence to itself and its subsequent messages to locate the abnormal messages in the sequence. We used the real dataset to test the abnormal message detection performance of MetraDS in comparison with state-of-the-art methods. The experimental results show that MetraDS improves the abnormal message detection accuracy of other methods by as much as 33.8%, and its memory and computational cost requirements are acceptable.