Linking Received Packet to the Transmitter Through Physical-Fingerprinting of Controller Area Network

TL;DR

This paper presents a novel physical fingerprinting method for CAN bus messages, enabling the identification of the transmitting ECU and channel with high accuracy, thereby enhancing security against spoofing attacks.

Contribution

The paper introduces a physical signal-based framework that links CAN packets to their source using unique artifacts from channel and device imperfections, employing neural networks for classification.

Findings

Achieves 95.2% accuracy in channel identification.

Achieves 98.3% accuracy in ECU identification.

Demonstrates robustness over multiple channels and ECUs.

Abstract

The Controller Area Network (CAN) bus serves as a legacy protocol for in-vehicle data communication. Simplicity, robustness, and suitability for real-time systems are the salient features of the CAN bus protocol. However, it lacks the basic security features such as massage authentication, which makes it vulnerable to the spoofing attacks. In a CAN network, linking CAN packet to the sender node is a challenging task. This paper aims to address this issue by developing a framework to link each CAN packet to its source. Physical signal attributes of the received packet consisting of channel and node (or device) which contains specific unique artifacts are considered to achieve this goal. Material and design imperfections in the physical channel and digital device, which are the main contributing factors behind the device-channel specific unique artifacts, are leveraged to link the received electrical signal to the transmitter. Generally, the inimitable patterns of signals from each ECUs exist over the course of time that can manifest the stability of the proposed method. Uniqueness of the channel-device specific attributes are also investigated for time- and frequency-domain. Feature vector is made up of both time and frequency domain physical attributes and then employed to train a neural network-based classifier. Performance of the proposed fingerprinting method is evaluated by using a dataset collected from 16 different channels and four identical ECUs transmitting same message. Experimental results indicate that the proposed method achieves correct detection rates of 95.2% and 98.3% for channel and ECU classification, respectively.