CANGuard: An Enhanced Approach to the Detection of Anomalies in CAN-Enabled Vehicles

Area of Science:

• Cybersecurity in automotive systems
• Network intrusion detection
• Machine learning applications in vehicle networks

Background:

• Controller Area Network (CAN) bus is crucial for modern vehicle communication but lacks inherent security.
• Vulnerabilities in CAN bus architecture make it susceptible to cyberattacks, compromising vehicle safety and functionality.
• Existing security measures are insufficient to address evolving threats in connected vehicles.

Purpose of the Study:

• To propose CANGuard, a real-time intrusion detection system (IDS) for CAN networks.
• To develop a system capable of detecting attacks and identifying the originating node on the CAN bus.
• To evaluate the effectiveness of machine learning models for CAN bus security.

Main Methods:

• Simulated a CAN-enabled system with four nodes representing different vehicle components.
• Generated a dataset of Denial-of-Service (DoS) attacks by exploiting CAN bus arbitration.
• Trained and evaluated multiple machine learning models, including Gradient Boosting and Multi-Layer Perceptron (MLP), for attack detection and node identification.

Main Results:

• Gradient Boosting model achieved high accuracy in both detecting DoS attacks and identifying the attacking node.
• Multi-Layer Perceptron (MLP) model showed strong attack detection capabilities but struggled with accurate node identification (<50% accuracy).
• The study demonstrated the feasibility of real-time attack detection and source identification in CAN networks.

Conclusions:

• CANGuard shows significant promise for enhancing the security of CAN-enabled vehicles.
• Tree-based machine learning models, particularly Gradient Boosting, are well-suited for real-time intrusion detection in automotive networks.
• Further research into robust node identification is crucial for comprehensive CAN bus security.