利用信号聚类相似性检测CAN伪装攻击
Detecting CAN Masquerade Attacks with Signal Clustering Similarity
摘要：
车辆控制器局域网（CAN）容易受到不同复杂程度的网络攻击。伪造攻击是最容易管理的--对手只需在CAN上发送（额外）帧--但也是最容易检测的，因为它们会破坏帧频率。为了克服基于时间的检测方法，攻击者必须通过发送帧来代替（因此在预期的时间）良性帧但带有恶意有效载荷来管理伪装攻击。研究工作已经证明，CAN攻击，特别是伪装攻击，可以影响车辆功能。例子包括导致意外加速，车辆制动器停用，以及转向车辆。我们假设伪装攻击修改了CAN信号时间序列的细微相关性以及它们如何聚集在一起。因此，群集分配的变化应指示异常行为。我们通过利用我们先前开发的逆向工程CAN信号的能力（即，CAN-D [控制器局域网解码器]），并专注于通过分析从原始CAN帧中提取的时间序列来检测伪装攻击的最新技术水平。具体来说，我们证明了伪装攻击可以通过计算时间序列聚类相似性，使用分层聚类的车辆的CAN信号（时间序列）和比较的聚类相似性在CAN捕获和没有攻击。我们在先前收集的具有伪装攻击的CAN数据集中测试了我们的方法（即，ROAD数据集），并开发一个取证工具作为概念证明，以证明所提出的方法用于检测CAN伪装攻击的潜力。
英文摘要：
Vehicular Controller Area Networks (CANs) are susceptible to cyber attacks of different levels of sophistication. Fabrication attacks are the easiest to administer -- an adversary simply sends (extra) frames on a CAN -- but also the easiest to detect because they disrupt frame frequency. To overcome time-based detection methods, adversaries must administer masquerade attacks by sending frames in lieu of (and therefore at the expected time of) benign frames but with malicious payloads. Research efforts have proven that CAN attacks, and masquerade attacks in particular, can affect vehicle functionality. Examples include causing unintended acceleration, deactivation of vehicle's brakes, as well as steering the vehicle. We hypothesize that masquerade attacks modify the nuanced correlations of CAN signal time series and how they cluster together. Therefore, changes in cluster assignments should indicate anomalous behavior. We confirm this hypothesis by leveraging our previously developed capability for reverse engineering CAN signals (i.e., CAN-D [Controller Area Network Decoder]) and focus on advancing the state of the art for detecting masquerade attacks by analyzing time series extracted from raw CAN frames. Specifically, we demonstrate that masquerade attacks can be detected by computing time series clustering similarity using hierarchical clustering on the vehicle's CAN signals (time series) and comparing the clustering similarity across CAN captures with and without attacks. We test our approach in a previously collected CAN dataset with masquerade attacks (i.e., the ROAD dataset) and develop a forensic tool as a proof of concept to demonstrate the potential of the proposed approach for detecting CAN masquerade attacks.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
