VehicleCIDS: An Efficient Vehicle Intrusion Detection System Based on Clock Behavior

Nowadays, more and more external interfaces are added into intelligent and connected vehicles. The in-vehicle network, especially the controller area network (CAN), is no longer a closed environment, which provides more approaches for attackers to invade. To resist attacks, numerous researchers have proposed intrusion detection systems (IDSs). However, attackers can intrude CAN bus in a more advanced way, such as masquerade attack, which leads to failures of most IDS. To counter masquerade attacks, we propose an efficient vehicle IDS based on clock behavior, called VehicleCIDS. First, the system uses recursive least squares (RLS) algorithm to estimate the clock behavior of each electronic control unit (ECU). Then, a statistical method called empirical rule is used to detect attack messages. Finally, it utilizes dynamic time warping (DTW) to identify attackers. The experimental results on real vehicles show that the recognition rate of VehicleCIDS can achieve 98.52% in intrusion detection and 87.71% in attacker identification.