WIP: Intrusion Detection and Localization for CAN by Extracting Propagation Delay..
summary
Proposes transmit signatures extracted from natural message intervals on CAN, claiming distance-dependent fingerprints that enable both detection and localization without hardware or ECU changes. Testbed varies ECU separation and shows signatures grow with distance, reveal an oscillatory pattern with peaks and troughs tied to clock sync and skew, and produce an extra 2TP round-trip delay observable at the monitor. Authors fit a linear model with three parameters and report a small MSE on prediction in controlled experiments.
AI-written summary · about
chapters (8)
- 0:00CAN intrusion detection intro
- 1:15Timing defenses for CAN impersonation
- 2:39Limitations of timing-based approaches
- 4:04Transmit signatures concept
- 6:11Transmit signatures as fingerprints
- 6:55Experimental observations and challenges
- 8:22Modeling transmit signatures
- 9:26Conclusion and future work
related talks
30mFingerprinting Electronic Control Units for Vehicle Intrusion Detection
04mToward Physical-Layer Fingerprinting of Production Automotive...
12mOn the Real-World Applicability of Automotive CAN Intrusion Detection Systems
14mAutoHack: A Physically Verified Multi-Bus CAN Dataset for Intrusion Detection...
41mIt's easier to break than to patch: a stealthy DoS attack on CAN
18mModels on the Move: Towards Feasible Embedded AI for Intrusion Detection on...
14mCANBERT+: An Optimized Multi-Layer BERT-Based Intrusion Detection for CAN Bus
42mCanspy: A Platform for Auditing Can Devices