Hyo Jin Jo

The low-frequency-band (LF-band) communication in the passive keyless entry and start (PKES) system is basically designed to enable short-range communication (1 to 2 m) through which a key fob determines whether it is in the vicinity of its paired vehicle. However, this short-range communication is vulnerable because it is unable to precisely verify the distance, as the LF-band signals can be easily relayed or amplified. In this article, we present a novel method (named low-frequency fingerprinting, LOFI ) to detect LF-band signals generated by an attacker. LOFI is designed as a subauthentication method that supports existing authentication systems for PKES systems. Through a series of experiments, we demonstrate that LOFI effectively detects attacks on the PKES system, achieving an average false positive rate (FPR) of 0.92% and an average false negative rate (FNR) of 0.01% under Non-Line-of-Sight (NLoS) conditions. Moreover, using a physics-based ray-tracing simulation, we analyze detection boundaries against feature impersonation attackers.

Recently, a number of cyber attacks on in-vehicle networks have been reported, with one of the main attack strategies being the masquerade attack, which impersonates other electronic control units (ECU). Subsequently, intrusion detection systems are mainly studied to detect masquerade attack attempts. However, existing research cannot detect certain masquerade attack attempts that use periodic and event messages, ultimately resulting in low detection rates. In this paper, we propose an acceptance filter-based intrusion detection system called PE-detector, which is able to detect a variety of masquerade attack types on the controller area network (CAN) bus including periodic and event message-based masquerade attacks with 100% accuracy when all ECUs are able to receive and transmit CAN messages from the CAN bus. If an arbitrary ECU cannot participate in CAN communications due to a DoS attack, PE-detector cannot detect a masquerade attack impersonating the corresponding node, but it is able to detect abnormal patterns of CAN bus caused by the DoS attack. In addition, since PE-detector is able to be added to the CAN bus as a dongle-type ECU board, no hardware changes to legacy ECUs are required. The proof-of-concept for PE-detector has been validated in a real vehicle.

With the advancement of connected and automated vehicles (CAVs), drivers now have access to convenient features such as lane-keeping, cruise control, and more. The electronic control units (ECUs) equipped within vehicles communicate with each other through the controller area network (CAN). However, since the CAN does not possess any security mechanisms, it becomes a target for adversaries to attack. In light of this, a significant amount of research regarding intrusion detection systems (IDSs) has focused on detecting such maliciously injected CAN packets. Nevertheless, most existing machine learning-based IDSs neither calculate the exact time intervals of the CAN packets nor utilize the counter information. Precise timing intervals are a crucial feature for detecting spoofing, fuzzing, and replay attacks, and counter information is also a significant feature that can detect fuzzing and replay attacks. Therefore, in this paper, we propose a methodology for extracting two detection features that are aware of CAN frame characteristics: the interframe space (IFS) between two consecutive CAN packets, and the counter information of a CAN data payload (i.e., data field). Using these features, we introduce decision tree-based IDS. We evaluate the proposed features with popular decision tree-based models such as random forest and extreme gradient boosting (XGBoost). The results show that our proposed IDS can detect maliciously injected CAN packets with an F1 score of 99.54% in binary classification and 97.99% in multi-class classification, which are higher scores than what existing machine/deep learning-based IDSs achieve. Additionally, we measure the detection time of our proposed IDS in both online and offline testing environments.

Contemporary vehicles have undergone numerous transformations to become fully computerized machines. This computerizing process is intended to provide safety and convenience for drivers; however, there have been many studies demonstrating how to remotely maneuver a vehicle by compromising its in-vehicle electronic control units (ECU). As a countermeasure, automotive intrusion detection systems (IDSs) have also been extensively explored as potential remedies. The clock-based IDS was one of the most promising methods for an automotive IDS, but researchers have recently determined it to be insufficient, as adversaries can emulate the clock skew. In this paper, we propose a novel automotive IDS that leverages the residuals—which have traditionally been considered an error that should be removed from analysis—of average and actual timestamp intervals of two consecutive controller area network (CAN) messages. Thus, we present a rationale as to why large residuals occur in a real in-vehicle CAN network. Our method analyzes transmission periodicity so closely that any minuscule change can be detected in the event of an intrusion. We show that our method detects a vehicle intrusion with a low false-alarm rate, and that it can detect a new sophisticated attack which emulates the clock skew of an original transmission. To the best of our knowledge, this is the first approach analyzing transmission time to detect the frequency masquerading attack with clock skew emulation. Finally, our method enables the sharing of parameters determined in a vehicle with other like models, which is meaningful for manufacturers in terms of scalability.

The security of in-vehicle networks has become an important issue as automobiles become more connected and automated. In this paper, we propose a window-based intrusion detection and classification technology, named G-IDCS, which aims to enhance the security of the in-vehicle controller area network (CAN) protocol. Existing intrusion detection systems (IDSs) using graph theory suffer from limitations, such as requiring a large number of CAN messages for detection and being unable to classify attack types despite analyzing numerous messages. Meanwhile, machine learning or deep learning-based systems have limited sensitivity to environmental changes such as attack type change due to model overfitting, and are unable to provide explanations for classification decisions. Using various graph features, our threshold-based intrusion detection method overcomes these limitations by integrating a threshold-based IDS and a machine learning-based attack type classifier. Our threshold-based intrusion detection method of G-IDCS reduces the number of CAN messages required for detection by more than 1/30 and improves the accuracy of combined attack detection by over 9% compared to an existing intrusion detection method that uses graph theory. Furthermore, unlike existing machine learning and deep learning-based intrusion detection systems, our threshold classifier is robust to changes in attack types and can provide explanations for the features used in attack detection. In addition, our machine learning-based attack type classifier outperforms existing techniques in all performance metrics and can serve as a digital forensic tool for investigating cyber attacks on in-vehicle networks. Using the classifier to identify attack types can facilitate the design of corresponding protection methods, thereby enhancing the security of in-vehicle networks.

With the development of IT technologies, event data recorder (EDR) devices are now installed in modern vehicles to record and analyze vehicle-related events. As data recorded in EDRs began to be used as conclusive proof in courts, many researchers turned their to focus on developing methodologies that can protect data recorded in EDRs from data forgery attacks. In general, these existing methods generate verification values for EDR data by using a digital signature algorithm. However, these methods do not provide a way to protect the data stored in an EDR from data forgery attacks in the event of an emergency, such as a car accident, and it is not possible to properly create a verification value for the EDR data due to unexpected and sudden events like a power supply problem. Thus, in this paper, we propose TB-Logger, a novel method that protects EDR data even when there is an emergency situation. TB-Logger relies on the trusted execution environment (TEE) to protect EDR data from data forgery attacks, which ultimately result in data modification, reordering, and deletion. In addition, in the event of an emergency, TB-Logger utilizes a blockchain system to store verification values and publicly verify the data generated during the event. We evaluated the practicality of TB-Logger using two real vehicles: the Hyundai Avante CN7 and the Tesla Model 3. Through these tests, we confirmed that TB-Logger can generate verification values for EDR data without incurring any data loss.

Modern vehicles are equipped with multiple Electronic Control Units (ECUs) that support various convenient driving functions, such as the Advanced Driver Assistance System (ADAS). To enable communication between these ECUs, the Controller Area Network (CAN) protocol is widely used. However, since CAN lacks any security technologies, it is vulnerable to cyber attacks. To address this, researchers have conducted studies on machine learning-based intrusion detection systems (IDSs) for CAN. However, most existing IDSs still have non-negligible detection errors. In this paper, we propose a new filtering-based intrusion detection system (FIDS) to minimize the detection errors of machine learning-based IDSs. FIDS uses a whitelist and a blacklist created from CAN datasets. The whitelist stores the cryptographic hash value of normal packet sequences to correct false positives (FP), while the blacklist corrects false negatives (FN) based on transmission intervals and identifiers of CAN packets. We evaluated the performance of the proposed FIDS by implementing a machine learning-based IDS and applying FIDS to it. We conducted the evaluation using two CAN attack datasets provided by the Hacking and Countermeasure Research Lab (HCRL), which confirmed that FIDS can effectively reduce the FP and FN of the existing IDS.

In various studies of attacks on autonomous vehicles (AVs), a phantom attack in which advanced driver assistance system (ADAS) misclassifies a fake object created by an adversary as a real object has been proposed. In this paper, we propose F-GhostBusters, which is an improved version of GhostBusters that detects phantom attacks. The proposed model uses a new feature, i.e, frequency of images. Experimental results show that F-GhostBusters not only improves the detection performance of GhostBusters but also can complement the accuracy against adversarial examples.

With the development of in-vehicle network technologies, Automotive Ethernet is being applied to modern vehicles. Scalable service-Oriented MiddlewarE over IP (SOME/IP) is an automotive middleware solution that is used for communications of the infotainment domain as well as that of other domains in the vehicle. However, since SOME/IP lacks security, it is vulnerable to a variety of network-based attacks. In this paper, we introduce a new type of intrusion detection system (IDS) leveraging on SOME/IP packet's header information and packet reception time to deal with SOME/IP related network attacks.