Intrusion detection systems on CAN Buses for commercial vehicles with SAE J1939 compliant communication

Abstract

The SAE J1939 protocol, built on the top of the CAN protocol, is a standard for heavy-duty in-vehicle networks. This commercial vehicle sector plays a significant role in various domains, including goods distribution, public transportation, construction, agriculture, forestry and marine vehicular technologies, etc., all of these being essential for the global economy. Given the high degree of inter-connectivity of modern vehicles and the numerous cyber-attacks reported in the past decade, detecting and preventing intrusions on J1939 communications is crucial. In the light of the above, this thesis proposes various intrusion detection systems for CAN buses focusing on the SAE J1939 heavy-duty vehicle buses. The techniques behind the design and implementation of these IDS varies from the use of machine learning algorithms, to deterring adversaries by concealing the content of CAN frames using symmetric encryption, or performing a fine-grained analysis at the control system level. A novel mechanism to decode the content of the CAN frames, ID and data field is introduced, which paves the way for real-time destruction of the intrusions before the complete reception of malicious frames. Also, a more in-depth analysis performed at control system level opens the road for complementing the traditional CAN bus attacks with more knowledgeable attacks that can evade the intrusion detection and for designing mitigation mechanisms to detect such attacks. The experimental part builds on realistic frameworks deployed within an industry-standard tool, i.e., the CANoe environment, which allows for the integration of adversary models and intrusion detection.