FIDS: Filtering-Based Intrusion Detection System for In-Vehicle CAN

Abstract

Modern vehicles are equipped with multiple Electronic Control Units (ECUs) that support various convenient driving functions, such as the Advanced Driver Assistance System (ADAS). To enable communication between these ECUs, the Controller Area Network (CAN) protocol is widely used. However, since CAN lacks any security technologies, it is vulnerable to cyber attacks. To address this, researchers have conducted studies on machine learning-based intrusion detection systems (IDSs) for CAN. However, most existing IDSs still have non-negligible detection errors. In this paper, we pro-pose a new filtering-based intrusion detection system (FIDS) to minimize the detection errors of machine learning-based IDSs. FIDS uses a whitelist and a blacklist created from CAN datasets. The whitelist stores the cryptographic hash value of normal packet sequences to correct false positives (FP), while the blacklist corrects false negatives (FN) based on transmission intervals and identifiers of CAN packets. We evaluated the performance of the proposed FIDS by implementing a machine learning-based IDS and applying FIDS to it. We conducted the evaluation using two CAN attack datasets provided by the Hacking and Countermeasure Research Lab (HCRL), which confirmed that FIDS can effectively reduce the FP and FN of the existing IDS.