More Like this

1. A PUF Based CAN Security Framework

   https://doi.org/10.1109/ISVLSI49217.2020.00094  

   Cultice, Tyler; Labrado, Carson; Thapliyal, Himanshu (July 2020, 2020 IEEE Computer Society Annual Symposium on VLSI (ISVLSI))

   null (Ed.)

   We propose a method to include security and reliability to the messages sent over the CAN bus. Our approach adheres to CAN standard ISO 11898-1. A reliable PUF response is used in key generation to create a unique shared AES-256 key between each ECU, allowing for all message paths to be encrypted. In addition, an HMAC system with a counter is implemented to help protect against replay attacks and message tampering within the network. 

   more » « less
2. TL-NID: Deep Neural Network with Transfer Learning for Network Intrusion Detection

   https://doi.org/10.23919/ICITST51030.2020.9351317  

   Masum, Mohammad; Shahriar, Hossain (December 2020, 15th International Conference for Internet Technology and Secured Transactions (ICITST))

   null (Ed.)

   Network intrusion detection systems (NIDSs) play an essential role in the defense of computer networks by identifying a computer networks' unauthorized access and investigating potential security breaches. Traditional NIDSs encounters difficulties to combat newly created sophisticated and unpredictable security attacks. Hence, there is an increasing need for automatic intrusion detection solution that can detect malicious activities more accurately and prevent high false alarm rates (FPR). In this paper, we propose a novel network intrusion detection framework using a deep neural network based on the pretrained VGG-16 architecture. The framework, TL-NID (Transfer Learning for Network Intrusion Detection), is a two-step process where features are extracted in the first step, using VGG-16 pre-trained on ImageNet dataset and in the 2 nd step a deep neural network is applied to the extracted features for classification. We applied TL-NID on NSL-KDD, a benchmark dataset for network intrusion, to evaluate the performance of the proposed framework. The experimental results show that our proposed method can effectively learn from the NSL-KDD dataset with producing a realistic performance in terms of accuracy, precision, recall, and false alarm. This study also aims to motivate security researchers to exploit different state-of-the-art pre-trained models for network intrusion detection problems through valuable knowledge transfer. 

   more » « less
3. ShadowAuth: Backward-Compatible Automatic CAN Authentication for Legacy ECUs

   https://doi.org/10.1145/3488932.3523263  

   Kim, Sungwoo; Yeo, Gisu; Kim, Taegyu; Rhee, Junghwan "John"; Jeon, Yuseok; Bianchi, Antonio; Xu, Dongyan; Tian, Dave (May 2022, Asia CCS'22)

   Controller Area Network (CAN) is the de-facto standard in-vehicle network system. Despite its wide adoption by automobile manufacturers, the lack of security design makes it vulnerable to attacks. For instance, broadcasting packets without authentication allows the impersonation of electronic control units (ECUs). Prior mitigations, such as message authentication or intrusion detection systems, fail to address the compatibility requirement with legacy ECUs, stealthy and sporadic malicious messaging, or guaranteed attack detection. We propose a novel authentication system called ShadowAuth that overcomes the aforementioned challenges by offering backward-compatible packet authentication to ECUs without requiring ECU firmware source code. Specifically, our authentication scheme provides transparent CAN packet authentication without modifying existing CAN packet definitions (e.g., J1939) via automatic ECU firmware instrumentation technique to locate CAN packet transmission code, and instrument authentication code based on the CAN packet behavioral transmission patterns. ShadowAuth enables vehicles to detect state-of-the-art CAN attacks, such as bus-off and packet injection, responsively within 60ms without false positives. ShadowAuth provides a sound and deployable solution for real-world ECUs. 

   more » « less
4. Analyzing Cache Side Channels Using Deep Neural Networks

   https://doi.org/10.1145/3274694.3274715  

   Zhang, Tianwei; Zhang, Yinqian; Lee, Ruby B. (December 2018, 34th Annual Computer Security Applications Conference (ACSAC))

   null (Ed.)

   Cache side-channel attacks aim to breach the confidentiality of a computer system and extract sensitive secrets through CPU caches. In the past years, different types of side-channel attacks targeting a variety of cache architectures have been demonstrated. Meanwhile, different defense methods and systems have also been designed to mitigate these attacks. However, quantitatively evaluating the effectiveness of these attacks and defenses has been challenging. We propose a generic approach to evaluating cache side-channel attacks and defenses. Specifically, our method builds a deep neural network with its inputs as the adversary's observed information, and its outputs as the victim's execution traces. By training the neural network, the relationship between the inputs and outputs can be automatically discovered. As a result, the prediction accuracy of the neural network can serve as a metric to quantify how much information the adversary can obtain correctly, and how effective a defense solution is in reducing the information leakage under different attack scenarios. Our evaluation suggests that the proposed method can effectively evaluate different attacks and defenses. 

   more » « less
5. Vulnerability of Controller Area Network to Schedule-Based Attacks

   https://doi.org/10.1109/RTSS52674.2021.00051  

   Hounsinou, Sena; Stidd, Mark; Ezeobi, Uchenna; Olufowobi, Habeeb; Nasri, Mitra; Bloom, Gedare (December 2021, 2021 IEEE Real-Time Systems Symposium (RTSS))

   The secure functioning of automotive systems is vital to the safety of their passengers and other roadway users. One of the critical functions for safety is the controller area network (CAN), which interconnects the safety-critical electronic control units (ECUs) in the majority of ground vehicles. Unfortunately CAN is known to be vulnerable to several attacks. One such attack is the bus-off attack, which can be used to cause a victim ECU to disconnect itself from the CAN bus and, subsequently, for an attacker to masquerade as that ECU. A limitation of the bus-off attack is that it requires the attacker to achieve tight synchronization between the transmission of the victim and the attacker’s injected message. In this paper, we introduce a schedule-based attack framework for the CAN bus-off attack that uses the real-time schedule of the CAN bus to predict more attack opportunities than previously known. We describe a ranking method for an attacker to select and optimize its attack injections with respect to criteria such as attack success rate, bus perturbation, or attack latency. The results show that vulnerabilities of the CAN bus can be enhanced by schedulebased attacks. 

   more » « less