Detecting In-vehicle CAN Message Attacks Using Heuristics and RNNs

  • Shahroz Tariq
  • Sangyup Lee
  • Huy Kang Kim
  • Simon S. WooEmail author
Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 11398)


In vehicle communications, due to simplicity and reliability, a Controller Area Network (CAN) bus is used as the de facto standard to provide serial communication between Electronic Control Units (ECUs). However, prior research reveals that several network-level attacks can be performed on the CAN bus due to the lack of underlying security mechanism. In this work, we develop an intrusion detection algorithm to detect DoS, fuzzy, and replay attacks injected in a real vehicle. Our approach uses heuristics as well as Recurrent Neural Networks (RNNs) to detect attacks. We test our algorithm with in-vehicle data samples collected from KIA Soul. Our preliminary results show the high accuracy in detecting different types of attacks.



We thank anonymous reviews for providing helpful feedback to improve this work. We also thank Korea Internet & Security Agency (KISA) and Korean Institute of Information Security & Cryptology (KIISC) for the release of CAN dataset. This research was supported by the MSIP (Ministry of Science, ICT and Future Planning), Korea, under the “ICT Consilience Creative Program” (IITP-2015-R0346-15-1007) supervised by the IITP (Institute for Information & communications Technology Promotion) and Basic Science Research Program through the NRF of Korea (NRF-2017R1C1B5076474).


  1. 1.
    Controller Area Network (CAN bus).
  2. 2.
  3. 3.
    Boudguiga, A., Klaudel, W., Boulanger, A., Chiron, P.: A simple intrusion detection method for controller area network. In: 2016 IEEE International Conference on Communications (ICC), pp. 1–7. IEEE (2016)Google Scholar
  4. 4.
    Hamming, R.W.: Error detecting and error correcting codes. Bell Labs Tech. J. 29(2), 147–160 (1950)MathSciNetCrossRefGoogle Scholar
  5. 5.
    Hoppe, T., Kiltz, S., Dittmann, J.: Security threats to automotive CAN networks – practical examples and selected short-term countermeasures. In: Harrison, M.D., Sujan, M.-A. (eds.) SAFECOMP 2008. LNCS, vol. 5219, pp. 235–248. Springer, Heidelberg (2008). Scholar
  6. 6.
    Hoppe, T., Kiltz, S., Dittmann, J.: Automotive IT-security as a challenge: basic attacks from the black box perspective on the example of privacy threats. In: Buth, B., Rabe, G., Seyfarth, T. (eds.) SAFECOMP 2009. LNCS, vol. 5775, pp. 145–158. Springer, Heidelberg (2009). Scholar
  7. 7.
    Hoppe, T., Kiltz, S., Dittmann, J.: Security threats to automotive can networks–practical examples and selected short-term countermeasures. Reliab. Eng. Syst. Saf. 96(1), 11–25 (2011)CrossRefGoogle Scholar
  8. 8.
    Lee, H., Jeong, S.H., Kim, H.K.: OTIDS: a novel intrusion detection system for in-vehicle network by using remote frame. In: Privacy, Security and Trust (PST) (2017)Google Scholar
  9. 9.
    Miller, C., Valasek, C.: A survey of remote automotive attack surfaces. Black Hat, USA (2014)Google Scholar
  10. 10.
    Miller, C., Valasek, C.: Remote exploitation of an unaltered passenger vehicle. Black Hat, USA (2015)Google Scholar
  11. 11.
    Müter, M., Asaj, N.: Entropy-based anomaly detection for in-vehicle networks. In: 2011 IEEE Intelligent Vehicles Symposium (IV), pp. 1110–1115. IEEE (2011)Google Scholar
  12. 12.
    Song, H.M., Kim, H.R., Kim, H.K.: Intrusion detection system based on the analysis of time intervals of can messages for in-vehicle network. In: 2016 International Conference on Information Networking (ICOIN), pp. 63–68. IEEE (2016)Google Scholar

Copyright information

© Springer Nature Switzerland AG 2019

Authors and Affiliations

  • Shahroz Tariq
    • 1
    • 2
  • Sangyup Lee
    • 1
    • 2
  • Huy Kang Kim
    • 3
  • Simon S. Woo
    • 1
    • 2
    Email author
  1. 1.Stony Brook UniversityStony BrookUSA
  2. 2.The State University of New York, Korea (SUNY-Korea)IncheonSouth Korea
  3. 3.Korea UniversitySeoulSouth Korea

Personalised recommendations