SwRI develops new intrusion detection system to improve connected vehicle cybersecurity

On November 2, the Southwest Research Institute (SwRI) developed an intrusion detection system (IDS) to protect ground vehicles from cyber threats in embedded systems and connected vehicle networks. The system was developed for military vehicles, but can also be used in passenger cars and commercial vehicles to detect anomalies.

(Image source: SwRI)

Developed by SwRI in collaboration with the U.S. Army Ground Vehicle Systems Center (GVSC) Ground Systems Cyber ​​Engineering (GSCE), the IDS technology uses digital fingerprints and algorithms to identify communication anomalies between automotive systems and components. Military, passenger and commercial vehicles use the standard Controller Area Network (CAN) bus protocol to enable communication across various nodes or electronic control units (ECUs).

For example, the CAN protocol notifies the dashboard display when a sensor detects low oil pressure or when the headlights are activated. It also relays operational communications for systems such as the transmission and other key automotive technologies.

“A cyberattack could be to send false information through the CAN protocol to alter or impede vehicle operation,” said Jonathan Wolford, an engineer at SwRI. “Such an attack on a connected vehicle could have catastrophic consequences.”

CAN has been the standard automotive protocol since 1986, providing a reliable and flexible platform for transmitting information, but cybersecurity protection was not designed in. As modern vehicles are increasingly connected via external networks, the CAN system is increasingly vulnerable to potential cyberattacks, especially sending false messages.

SwRI's new algorithms extract information using digital fingerprints on nodes that transmit information over the CAN bus protocol. The digital fingerprints enable SwRI's intrusion detection system to identify when unknown/invalid nodes or computers are connected to a vehicle network. Using the message transmissions of a CAN transceiver, the algorithms track low-level physical layer characteristics, such as minimum and maximum voltages and voltage slew rates for each CAN frame, to create these digital fingerprints.

The researchers used baseline data to train the system to establish a fingerprint for each node to learn the characteristics and better identify anomalies. Through digital fingerprinting, the intrusion system can accurately identify messages from unauthorized nodes, or when a valid node sends a false message, indicating a "masquerade attack."

After training the system, SwRI engineers injected fake data, which the algorithm immediately flagged, so the system was able to identify threats and defend against them.

“In theory, these attacks are simple enough for a hacker with physical access to the vehicle, but vehicles are also vulnerable to wireless attacks,” said Peter Moldenhauer, an engineer at SwRI and a participant in the research. “As we move toward more connected and automated vehicle networks, our system aims to build cyber resilience into the CAN protocol.”