hh.sePublikationer
Ändra sökning
RefereraExporteraLänk till posten
Permanent länk

Direktlänk
Referera
Referensformat
  • apa
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • Annat format
Fler format
Språk
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Annat språk
Fler språk
Utmatningsformat
  • html
  • text
  • asciidoc
  • rtf
Real-time intrusion detection in CAN-bus networks: Addressing zero-day attacks through feature engineering
Högskolan i Halmstad, Akademin för informationsteknologi.
Högskolan i Halmstad, Akademin för informationsteknologi.
2024 (Engelska)Självständigt arbete på avancerad nivå (masterexamen), 20 poäng / 30 hpStudentuppsats (Examensarbete)
Abstract [en]

The introduction of modern connected vehicles has led to increased safety and comfort. It also introduces new attack surfaces that could be exploited by malicious actors during an attack targeting the electronic control units (ECU) in the vehicle. The ECUs control safety-critical components in the vehicle, and a successful attack could lead to catastrophic consequences. The most common network type for inter-ECU communication is CAN-bus, which is a reliable and lightweight protocol, but it was never intended to withstand cyber security threats.This master thesis explores different approaches to CAN-bus intrusion detection systems (IDS) and evaluates them in terms of capability to detect previously unknown attacks (zero-day), real-time performance and implementation feasibility on a typical embedded device. To the best of our knowledge, these requirements have not been evaluated together in previous research. High-level features are created and evaluated in order to include as many aspects of the data as possible. The different approaches are evaluated by exposing them to attacks commonly used in previous research, as well as a data-altering attack introduced in the thesis.The experiments show that the best-performing approach is to model the behaviour of every single ECU on the network with a separate support vector machine (SVM) and a set of high-level features that capture the timing and data payload aspects of CAN-bus traffic. This approach achieves a detection rate of more than 99% and a false positive rate during normal operation below 0.01% in the majority of cases. More long-term features are also explored, but they do not conform to the real-time requirements.

Ort, förlag, år, upplaga, sidor
2024. , s. 59
Nyckelord [en]
CAN, CAN bus, Intrusion detection, IDS, Anomaly detection, Feature engineering, Real-time, ECU, Zero-day
Nationell ämneskategori
Datorteknik
Identifikatorer
URN: urn:nbn:se:hh:diva-54129OAI: oai:DiVA.org:hh-54129DiVA, id: diva2:1879085
Ämne / kurs
Datateknik
Utbildningsprogram
Masterprogram i inbyggda och intelligenta system
Handledare
Examinatorer
Tillgänglig från: 2024-07-23 Skapad: 2024-06-27 Senast uppdaterad: 2024-07-23Bibliografiskt granskad

Open Access i DiVA

fulltext(1393 kB)200 nedladdningar
Filinformation
Filnamn FULLTEXT02.pdfFilstorlek 1393 kBChecksumma SHA-512
e9ad214df1835c6537bc3f6f7589201d3f10d9cdd7c34fdf4869f67ec5fc46f82721f788709073503a99e4704d3466255b22ff7fc7f7220ede2ddca173fdcf0a
Typ fulltextMimetyp application/pdf

Av organisationen
Akademin för informationsteknologi
Datorteknik

Sök vidare utanför DiVA

GoogleGoogle Scholar
Totalt: 201 nedladdningar
Antalet nedladdningar är summan av nedladdningar för alla fulltexter. Det kan inkludera t.ex tidigare versioner som nu inte längre är tillgängliga.

urn-nbn

Altmetricpoäng

urn-nbn
Totalt: 704 träffar
RefereraExporteraLänk till posten
Permanent länk

Direktlänk
Referera
Referensformat
  • apa
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • Annat format
Fler format
Språk
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Annat språk
Fler språk
Utmatningsformat
  • html
  • text
  • asciidoc
  • rtf