Simulation and Detection of Bus-Off Attacks in CAN

This work presents a simulation framework for CAN communication including attacks, with a particular focus on bus-off and WeepingCAN attacks. The simulation is validated against existing experiments, demonstrating its accuracy in replicating attack scenarios proposed by Cho et al. [11] and Bloom [2]. An intrusion detection system (IDS) is evaluated using the Hacking and Countermeasures Research Lab (HCRL) data set, and limitations in detecting WeepingCAN attacks are identified. To address these limitations, an extension to the IDS is proposed that incorporates an error frequency criterion to improve detection accuracy. The extended IDS is evaluated in different environments, demonstrating its effectiveness in reliably distinguishing between normal communications and WeepingCAN attacks. Overall, this work contributes to the understanding and detection of sophisticated attacks on CAN and and offers support to develop and evaluate further detection mechanisms.