An experimental study towards attacker identification in automotive networks

The auxiliary functions of modern vehicles have increased the number of attack surfaces. As the most important information exchange channel for vehicles, Controller Area Network (CAN) attracts more and more attention. Due to no encryption and authentication, CAN bus is vulnerable to attack. Thus, the attacker can manipulate the message with serious consequences. Several methods have been proposed to improve the security of vehicles. However, most of them have their own deficiencies. In this paper, we propose an LOF-based attack detection scheme which utilizes the voltage physical characteristics of the CAN frame to judge whether a message is transmitted by a legitimate Electronic Control Unit (ECU). As validated by extensive experiments on two vehicles, our scheme can identify the attacker with an average detection rate of 98.9%, and the false detection rate is less than 0.5%. In addition, our scheme can accurately identify attacks from external devices.