CAN-Bus Intrusion Detection Using Timing Rules and Machine Learning

Which detector finds attacks on a car's CAN bus with the fewest false alarms? On the ROAD captures of one vehicle (Oak Ridge National Laboratory; 45 recorded captures, 2.98 h of normal driving) and with a split by whole captures, a simple per-ID period rule reaches F1 0.943 at 18.8 false alarm episodes per hour, a Random Forest is near perfect on attack types it has seen but finds only 1 % of the frames of a type it has not, and only a per-signal range rule catches masquerade attacks (0.608 of their frames). Research demonstration on recorded data of one vehicle. It is not a vehicle security product and has not been tested on a live vehicle. The application only reads logs and raises alarms for a person to look at. It sends nothing to any CAN bus.

Category: Automobile Engineering

Automobile Engineering Project AU07 from ProTechSC Academy, with graphical abstract, video demonstration and project guidance.