Universally Applicable Signal-Based Controller Area Network (CAN) Intrusion Detection System

Information NoticeCAN-D: Controller Area Network Decoder (UT-B ID 202004299) and Universally Applicable Signal-Based Controller Area Network (CAN) Intrusion Detection System (UT-B ID 202004640)Technology SummaryProblem: Modern vehicles rely on controller area networks (CANs) to internally communicate information about vehicular functions, such as accelerator pedal angle, brakes, and wheel speeds. Monitoring and improving the efficiency, performance, safety, and security of vehicles depends on decoding the CAN data, but decoding these signals requires proprietary definitions that vary drastically across makes, models, years, and trims. Thus, decoding efforts are per-vehicle endeavors that are manual, tedious, and inadequate for many signals that relay information from latent sensors. This poses a major obstacle for after-market modifications like performance tuning and in-vehicle network security measures. Without available signal definitions, vehicles are dramatically exposed to cyberattacks with potentially disastrous consequences.Solution:ORNL’s Controller Area Network Decoder (CAN-D) technology is a data-driven vehicle agnostic-method for reverse engineering CAN message definitions. This innovation creates an ecosystem of monitoring that allows for improved vehicle performance, efficiency, safety, and security. CAN-D is universally applicable, designed to be used in vehicles across manufacturers. It is also the only known technology that can reverse engineer all four parts of a signal definition. CAN-D is prototyped as a plug-in technology for in-situ use or post-drive analysis and promises greater vehicle safety, efficiency, and security for fleet management, cybersecurity, electrification, automated driving, and V2X tech companies. In this manner, CAN-D can be used for decoding CAN communications without access to CAN data mapping. Moreover, the decoded CAN communications can be used for detecting intrusion of the underlying CAN data.Impact: CAN-D enables an ecosystem of technologies that interact with each other on the CAN bus in real time, creating opportunities for enhanced performance, efficiency, safety, and security of vehicles on the road regardless of manufacturer.The global automotive cybersecurity market is expected to grow from $6.2 Billion in 2021 to $28.7 billion by 2030, at a CAGR of 18.6% during the forecast period 2022-2030.Applications: Cybersecurity in the transportation industry Fleet management Vehicle fault diagnosis Fuel efficiency monitoring Post-accident forensicsAdvantages: Provides access to real-time measurements of vehicle subsystems Universally applicable Can process and identify raw signals within nearly any CAN No prior knowledge of specific signal definitions requiredAdditional Information:Publications: M. E. Verma, R. A. Bridges, J. J. Sosnowski, S. C. Hollifield, and M. D. Iannacone, “CAN-D: A Modular Four-Step Pipeline for Comprehensively Decoding Controller Area Network Data,” IEEE Trans. Veh. Technol., 2021. DOI: 10.1109/TVT.2021.3092354. P. Moriano, R. A. Bridges, and M. D. Iannacone, “Detecting CAN Masquerade Attacks with Signal Clustering Similarity,” Workshop on Automotive and Autonomous Vehicle Security (AutoSec) 2022, https://doi.org/10.48550/arXiv.2201.02665. Demos: https://www.youtube.com/watch?v=7KiEUVF_oWs https://www.youtube.com/watch?v=TWIfMKr3gnc

---

---