Fingerprinting Electronic Control Units for Vehicle Intrusion Detection
summary
Proposes Clock-based IDS (CIDS) that fingerprints ECUs by extracting clock skews from periodic CAN messages, fits per-ECU linear models with Recursive Least Squares (RLS) and flags sudden identification errors with Cumulative Sum (CUSUM). Built and tested on a CAN prototype (CAN shield + Arduino), a 2013 Honda Accord and logged drives from a 2010 Toyota Camry/Dodge Ram. Detects fabrication, suspension and masquerade attacks (900 injected attacks in evaluation), yields 0.055% false positives, enables root-cause ECU identification, and detects masquerade within ~100 ms for 10-message windows.
AI-written summary · about
chapters (7)
- 0:00Introduction to vehicle risk
- 1:09Vehicle network vulnerabilities
- 2:27Attack models and challenges
- 5:25Fingerprinting via clock skew
- 10:53Intrusion detection techniques
- 14:50Experimental evaluation
- 21:04Conclusion and Q&A
related talks
04mToward Physical-Layer Fingerprinting of Production Automotive...
11mWIP: Intrusion Detection and Localization for CAN by Extracting Propagation Delay..
11mIs Your ECU Really Yours?
41mIt's easier to break than to patch: a stealthy DoS attack on CAN
12mOn the Real-World Applicability of Automotive CAN Intrusion Detection Systems
14mAutoHack: A Physically Verified Multi-Bus CAN Dataset for Intrusion Detection...
18mModels on the Move: Towards Feasible Embedded AI for Intrusion Detection on...
37mAutomatic Automotive Hacking