Automobile Intrusion Detection Jun Li Twitter @bravo_fighter - - PowerPoint PPT Presentation

Jun Li

Twitter：@bravo_fighter

UnicornTeam

Qihoo360

Automobile Intrusion Detection

2

What this talk is about? Automotive intrusion detection Automotive cyber-security architecture

3

From the highest viewpointJ

Outline

• Quick recap of the status quo of

car security research

• Little automobile working principle
• CAN bus anomaly detection

Performance Tuning by modifying firmware Immobilizer Cracking （Hitag， Keeloq） DARPA&UW OBD interface attack，etc. Karl et al. Remote attack via wireless OBD interface Telsa Qihoo360

BMW

ConnectedDrive

vuln

Mbrace

Jeep Uconnect Charlie&Chris

GM Onstar Vuln,Sammy More to come ？ Sure！

Car hacking development

Car explained

Sensor security

In automotive electronics, Electronic Control Unit (ECU) is a generic term for any secret system that controls one or more of the electrical system or subsystems in a transport vehicle Types of ECU include Electronic/engine Control Module (ECM), Powertrain Control Module (PCM), Transmission Control Module (TCM), Brake Control Module (BCM or EBCM), Central Control Module (CCM), Central Timing Module (CTM), General Electronic Module (GEM), Body Control Module (BCM), Suspension Control Module (SCM), control unit, or control module

ECU (Electronic Control Unit)

Electronic Control Module Example

9

Automotive Mechatronics

10

Non-hackable hackable

11

Throttle position sensor

Drive-by-wire system

12

Steering-by-wire system

Universal joint Steer-by –wire （with mechanical fallback clutch）

Automotive Control System Architecture

Vehicle CAN BUS System

Vehicle Communication System

OBDII

MOST LIN CAN FlexRay Bluetooth Wifi SubGHz Infotainment System

ESP TCU ACC

ESP（electronic stability program） TCU（transmission control unit） ACC（adaptive cruise control）

… CAN-C 网关 Speedometer CAN-B Infotainment System

Music Player

INS（Inertial navigation system）

INS EMU

EMU（engine management

system）

Seat Controller

Vehicle Communication System example

CAN BUS Signaling

CAN Frame Structure

0 dominant 1 recessive 1 1 1 1 1 1 1 1 0 1 1 1 0 0 0 0 0 0

CAN Bus Access Arbitration

Packets injection Parameter spoofing

CAN BUS Attack

Jeep Uconnect Vulnerability

WiFi femotocell Sprint Internet CAN

Remote Attack Example

Automotive intrusion detection researches

Automotive intrusion detection researches

Not considering Temporal feature

Distributed architecture

CAN总线安全防御模型 IDS IDS（Intrusion Detection System）

① Real time requirements ② Hard to trace back to sender ③ High cost of false positive ④ …

Difficulties of CAN bus defence

CAN Anomaly Detection

McAfee&Intel

CAN bus defence

IDS

CAN security architecture

Bluetooth WiFi Cellular V2X IDS

Experiment Car

• Cellular Connection
• Cloud Service
• Bluetooth Key
• Hybrid
• Electronic Brake
• Electric Power

Steering

• Electronic Throttle

Experiment car’s CAN network

The CAN database

Why don’t we build a model Take the relation ship of rpm and speed ， gear for example，we can create a model of the System‘s behavior

汽车工作原理

Anomaly detection system

Realtime data stream Cross Prediction Parameter extraction

System model requirements

Gear

Build the system model

Data Collection Data preprocess Data analysis Feature Selection

Model Training &Testing

Data Acquisition

Parameter presence on different BUS

Parameter Speed Engine RPM Acceleration Pedal Intake Pressure Brake Pedal Steering Wheel Gear

BUS

Instrument

• x

x

• Comfort
• x

x

• x

x

Power

• x

x

ECM

• x
• ESC
• x

Data Acquisition Setup

Data Analysis

Can database is kept highly confidential

Data Preprocess

Data Preprocess

Interpolation Sampling Normalization

Normalization Must make sure the maximum and minimum value，don’t calculate from the training data

数据插值

Observation Interpolation

Sub-Sampling

Sub-Sampling

Time_ ms RPM Speed MAP MAF AccPeda l Throttle 13897 3 0.287983 8 0.134259 2 0.059055 1 0.167567 5 0.697107 0.137795 2 13897 4 0.287312 5 0.134259 2 0.055118 1 0.167567 5 0.697107 0.137795 2 13897 5 0.287312 5 0.134259 2 0.051181 1 0.167567 5 0.697107 0.137795 2 13897 6 0.285970 0.134259 2 0.047244 0.167567 5 0.697107 0.137795 2 13897 7 0.285970 0.134259 0.051181 1 0.167567 5 0.697107 0.137795 2

Sub-Sampling

Model training

Model training

Results

Result

Model testing

Model testing

Acknowledgement Professor Shuicheng Yan Doctor Ming Lin Doctor Zhanyi Wang Doctor Lin Huang

Thank You！ Q&A

Reference

• 1. Karl Koscher, Alexei Czeskis, Experimental Security Analysis of a Modern

Automobile, 2010

• 2. Stephen Checkoway,Damon McCoy，Brian Kantor, Comprehensive Experimental

Analyses of Automotive Attack Surfaces，2011.

• 3. Charlie Miller，Chris Valasek，Adventures in Automotive Networks and Control

Units，2013.

• 4. Charlie Miller，Chris Valasek，Remote Exploitation of an Unaltered Passenger

Vehicle，2015

• 5. Dieter Spaar，Sicherheitslücken bei BMWs ConnectedDrive/ Beemer, Open

Thyself! – Security vulnerabilities in BMW's ConnectedDrive,2015.

• 6. Iamthecarvalry.org , Five Star Automotive Cyber Safety Framework，2015.
• 7. Pierre Kleberger，Security Aspects of the In-Vehicle Network in the Connected

Car，IEEE Intelligent Vehicles Symposium，2011

• 8. Marc Rogers，Kevin Mahaffey，How to Hack a Tesla Model S，DEF CON

23,2015

• 9. Charlie Miller Chris Valasek，Advanced CAN Injection Techniques for Vehicle

Networks，BlackhatUSA，2016

• 10. Kyong-Tak Cho and Kang G. Shin, Fingerprinting Electronic Control Units for

Vehicle Intrusion Detection, 2016

• 11. Nobuyasu Kanekawa,X-by-Wire Systems,Hitachi Research Lab.2011
• 12. Paul Yih, Steer-by-Wire: Implication For Vehicle Handling and Safety，Stanford

PHD Dissertation，2005

• 13. Luigi Coppolion，Dependability aspects of automotive x-by-wire technologies，

2008.

• 14. Jonas Zaddach,Andrei Costin,Embedded Devices Security and Firmware Reverse

Engineering，Blackhat Workshop,2013.

• 15. Andrei costin，Jonas Zaddach，A large-Scale Analysis of the Security of

Embedded Firmwares，EURECOM，2014.

• 16. Samy Kamkar，Drive It Like You hacked It，DEF CON23，2015
• 17. David A Brown, Geoffrey Cooper, Automotive Security Best Practices, White

Paper by Intel & McAfee,2014.

• 18. OpenGarages, Car Hacker’s Handbook，openGarage.org,2014.
• 19. Henning Olsson, OptimumG，Vehicle Data Acquisition Using CAN,2010
• 20. Varun Chandola，Arindam Banerjee，Vipin Kumar，Anomaly Detection ：A

Survey，2009

• 21. Park, Ming Kuang, Neural learning of driving environment prediction for vehicle

power management, Joint Conf. on Neural Networks, 2008.

• 22. Taylor, P., Adamu-Fika, F., Anand, S., Dunoyer, A., Griffiths, N., and Popham, T.

Road type classification through data mining，2012.

• 23. Michael Muter, Naim Asaj，Entropy-based anomaly detection for in-vehicle

networks", IEEE Intelligent Vehicles Symposium (IV), 2011.

• 24. Ulf E. Larson, Dennis K. Nilsson,An Approach to Specification-based Attack

Detection for In-Vehicle Networks, IEEE Intelligent Vehicles Symposium,2008.

• 25. Y. L. Murphey, Zhi Hang Chen, L. Kiliaris, Jungme ,I. Tang and T. P. Breckon,

Automatic road environment classication, IEEE Trans. on Intelligent Transportation Systems, 2011.

• 26. Salima Omar, Asri Ngadi, Hamid H.Jebur, Machine Learning Techniques for

Anomaly Detection: An Overview.

• 27. Perter Harrington，Machine Learning In Action，2013.
• 28. Jurgen Schmidhuber， Deep learning in neural networks: An overview， 2015.
• 29. Kaiserslautern，Comparison of Unsupervised Anomaly Detection Techniques，

German Research Center for Artificial Intelligence, 2011

• 30. Sepp Hochreiter, Jurgen Schmidhuber, Long short-term memory,Neural

computation, 1997.

• 31. Michael Husken, Peter Stagge,Recurrent neural networks for time series

classifcation, Neurocomputing, 2003.

• 32. Felix A Gers, Jurgen Schmidhuber, Fred Cummins, Learning to forget:Continual

prediction with LSTM, Neural computation, 2000.

• 33. David E Rumelhart, Geo_rey E Hinton, and Ronald J Williams.，Learning

internal representations by error propagation，1985.

• 34. Christopher M Bishop,Pattern recognition and machine learning, springer, 2006.
• 35. Simon Haykin and Neural Network. A comprehensive foundation. Neural

Networks, 2004.

• 36. Eleazar Eskin,Andrew Arnold,Michael Prerau, A Geometric Framework for

Unsupervised Anomaly Detection-Detecting Intrusions in Unlabeled Data tection-Detecting Intrusions in Unlabeled Data,2002.

• 37. Kingsly Leung, Christopher Leckie, Unsupervised Anomaly Detection in

Network Intrusion Detection Using Clusters, 2005