A language-based intrusion detection approach for automotive embedded networks

Ivan Studnia (1) , Eric Alata (2) , Vincent Nicomette (2) , Mohamed Kaâniche (2) , Youssef Laarouchi (2)

1 UR - Université de Rennes
2 LAAS-TSF - Équipe Tolérance aux fautes et Sûreté de Fonctionnement informatique

The increase in connectivity and complexity of modern automotive networks presents new opportunities for potential hackers trying to take over a vehicle. To protect the automotive networks from such attacks, security mechanisms, such as firewalls or secure authentication protocols may be included. However, should an attacker succeed in bypassing such measures and gain access to the internal network, these security mechanisms become unable to report about the attacks ensuing such a breach, occurring from the internal network. To complement these preventive security mechanisms, we present a non intrusive network-based intrusion detection approach fit for vehicular networks, such as the widely used CAN. Leveraging the high predictability of embedded automotive systems, we use language theory to elaborate a set of attack signatures derived from behavioural models of the automotive calculators in order to detect a malicious sequence of messages transiting through the internal network.

Mots clés: automotive networks; security; intrusion detection; CAN; finite state automata

Domaines: Informatique [cs]; Systèmes embarqués; Cryptographie et sécurité [cs.CR]

Ivan Studnia, Eric Alata, Vincent Nicomette, Mohamed Kaâniche, Youssef Laarouchi. A language-based intrusion detection approach for automotive embedded networks. IEEE Pacific Rim International Symposium on Dependable Computing ( PRDC ), Nov 2015, Zhangjiajie, China. ⟨hal-01967640⟩