New Methods for Security and Privacy of
CAN Bus Communication

Ph.D. Dissertation of András Gazdag

Supervisor: Prof. Levente Buttyán

Abstract

The last decades of the automotive industry have seen a significant change with the adoption of embedded controllers. Digital circuits and software components have taken control of processes previously controlled by analog methods. In addition to supporting more integrated functions and services, the primary motivation for this change was to reduce manufacturing costs. While delivering the expected results, this shift also created an undesirable problem: vehicles inherited the cybersecurity weaknesses of computers. If an attacker can take control of a computer-controlled physical process in an attack, it can cause physical damage by logical means. In the transportation industry, such an attack could endanger human lives or cause significant financial loss.

In this dissertation, we address some of the new challenges. We investigate the problems of

• compressing CAN traffic data to facilitate efficient data storage over a long period, allowing long-term traffic analysis;
• anomaly detection in CAN communication:
  • we proposed an algorithm for message injection detection on the compressed CAN logs;
  • we proposed a method that exploits correlations between transmitted signals and proves that message modification attacks against significant signals can be efficiently detected using models built on correlations;
  • we proposed a machine learning-based anomaly detection method for detecting message modification attacks that predicts individual signal values and detects anomalies based on the prediction error;
• vehicular data release: we show that the data transmitted over the internal network can also be used to reconstruct the movement of vehicles for short and long distances.