A Robust Physical Layer IDS for Intra-Vehicle Communication Security

The Controller Area Network protocol is widely adopted in the automotive industry to enable efficient communication between electronic control units (ECU s). While CAN protocol offers impressive speed, reliability, and robustness, its vulnerability to security threats arises from the absence of message authentication and encryption. Unfortunately, current CAN bus anomaly detection mechanisms mainly focus on detecting data link layer attacks, overlooking the critical task of identifying attackers who specifically target identity falsification. These malicious actors manipulate the identities of legitimate ECU s to launch attacks, potentially resulting in severe consequences, including the unwarranted blocking of genuine nodes. To counter this critical security concern, this paper specifically investigates the importance of the identification of the attacker and its behavior in maximizing the strengths of the CAN bus security while enhancing data-link level anomaly detection. Our approach leverages signal fingerprints generated by semiconductor imperfections, contextual message features, and the correlation of the decoded messages over time to accurately identify malicious ECU s and detect any packet manipulations. More precisely, we propose a multitask learning approach that extracts features from voltage signals measured on the CAN bus and the encoded data within the messages, enabling accurate identification of the attack type and its source. Through validation using a voltage dataset, we demonstrate the effectiveness and resilience of our approach against prominent attacks.