CAN 메시지의 주기성과 시계열 분석을 활용한 비정상 탐지 방법
Detection of Abnormal CAN Messages Using Periodicity and Time Series Analysis
2
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
최근 자동차 산업의 기술 발전과 함께 네트워크 연결성이 증대되고 있다. CAN(Controller Area Network) 버스 기술은 차량 내 다양한 전자기기와 시스템 간의 신속하고 효율적인 데이터 통신을 가능하게 하여, 핵심 시스템부터 다양한 기능을 통합 관리할 수 있는 플랫폼을 제공한다. 그러나 이러한 연결성 증가는 외부 공격자가 자동차 네트워크에 접근하여 차량 제어를 장악하거나, 개인 정보를 탈취하는 등 네트워크 보안 우려를초래할 수 있다. 본 논문은 CAN에서 발생하는 비정상 메시지를 분석하여, 메시지 발생 주기성 또는 빈도와 데이터 변화량이 비정상 메시지의탐지에 중요한 요소임을 확인하였다. DBC 디코딩을 통해 CAN 메시지의 구체적인 의미를 해석하였다. 이를 바탕으로 메시지 발생의 주기성과추이 분석을 위해 GRU 모델을 활용하여 일정 주기 이내에 발생한 메시지에 대해 예측 메시지와 발생한 메시지의 차이(잔차)를 비정상 측도로이용한 비정상 분류 모델을 제안하고 비정상 메시지의 공격 기법에 대한 다중 분류에는 메시지와 발생 주기, 잔차를 이용한 랜덤 포레스트 모델을도입하여 다중 분류기로 활용하여 성능 향상을 이루었다. 이 모델은 비정상 메시지 탐지에서 99% 이상의 높은 정확도를 달성하며 기존의 다른모델보다 우수한 성능을 보여주었다.
Abstract
Recently, with the advancement of technology, the automotive industry has seen an increase in network connectivity. CAN (ControllerArea Network) bus technology enables fast and efficient data communication between various electronic devices and systems within avehicle, providing a platform that integrates and manages a wide range of functions, from core systems to auxiliary features. However,this increased connectivity raises concerns about network security, as external attackers could potentially gain access to the automotivenetwork, taking control of the vehicle or stealing personal information. This paper analyzed abnormal messages occurring in CAN andconfirmed that message occurrence periodicity, frequency, and data changes are important factors in the detection of abnormal messages. Through DBC decoding, the specific meanings of CAN messages were interpreted. Based on this, a model for classifying abnormalitieswas proposed using the GRU model to analyze the periodicity and trend of message occurrences by measuring the difference (residual)between the predicted and actual messages occurring within a certain period as an abnormality metric. Additionally, for multi-classclassification of attack techniques on abnormal messages, a Random Forest model was introduced as a multi-classifier using messageoccurrence frequency, periodicity, and residuals, achieving improved performance. This model achieved a high accuracy of over 99%in detecting abnormal messages and demonstrated superior performance compared to other existing models.
참고문헌 (23)
- ISO, "11898-1: 2003-Road vehicles–Controller area network" (2003), International Organization for Standardization
- "2024 Global Automotive Cybersecurity Report" (2024)[URL]
- M. Charlie, "Remote exploitation of an unaltered passenger vehicle", Black Hat USA 2015, (S 91) (2015)
- S. Nie, "Free-fall : Hacking tesla from wireless to can bus", Briefing, Black Hat USA, 25, pp.1~16 (2017)
- K. Kim, "Cybersecurity for autonomous vehicles : Review of attacks and defense", Computers & Security, 103, pp.102150~ (2021)
- S. Lee, "Research trends on techniques for identifying malicious ECUs in CAN networks", Review of KIISC, 33(4), pp.47~55 (2023)
- S. H. Min, "Intrusion detection system based on the analysis of time intervals of CAN messages for in-vehicle network", 2016 International Conference on Information Networking(ICOIN), pp.63~68 (2016), IEEE
- B. Koltai, "Supporting CAN bus anomaly detection with correlation data", ICISSP, pp.285~296 (2024)
- S. Tariq, "CAN-ADF : The controller area network attack detection framework", Computers & Security, 94, pp.101857~ (2020)
- J. Khan, "Intrusion detection system can-bus in-vehicle networks based on the statistical characteristics of attacks", Sensors, 23(7), pp.3554~ (2023)
- C. Wang, "Traffic anomaly detection algorithm for CAN bus using similarity analysis", High-Confidence Computing, pp.100207~ (2024)
- M. D. Hossain, "LSTM-based intrusion detection system for in-vehicle can bus communications", IEEE Access, 8, pp.185489~185502 (2020)
- K. Serag, "ZBCAN: A Zero-Byte CAN Defense System", 32nd USENIX Security Symposium, Anaheim (2023)
- X. Wang, "Intrusion Detection System for In-Vehicle CAN-FD Bus ID Based on GAN Model", IEEE Access (2024)
- T. N. Hoang, "Supervised contrastive ResNet and transfer learning for the in-vehicle intrusion detection system", Expert Systems with Applications, 238, pp.122181~ (2024)
- S. O. Kim, "A study on the GAN-TREE Based vehicle network intrusion detection system", Proceedings of the Korean Institute of Communications and Information Sciences Conference(KICS), pp.1444~1445 (2024)
- T. N. Hoang, "Detecting in-vehicle intrusion via semi-supervised learning-based convolutional adversarial autoencoders", Vehicular Communications, 38, pp.100520~ (2022)
- R. Shafique, "Enhancing in-vehicle network security against ai-generated cyberattacks using machine learning", 2024 IEEE Wireless Communications and Networking Conference(WCNC) (2024), IEEE
- (2024)[URL]
- Y. E. Seo, "Method for Improving QQ-based Oxygen Extraction Fraction Estimation Accuracy through GRU Model", Journal of Korean Institute of Information Technology, 22(7), pp.131~139 (2024)
- Olah, Christopher, "Understanding lstm networks", ~ (2015)
- H. Kang, "Car Hacking : Attack & Defense Challenge 2020Dataset", IEEE (2021)
- S. R. Kim, "Anomaly CAN message detection using heuristics and XGBoost", Proceedings of the Annual Symposium of Korea Information Processing Society Conference(KIPS), 31(1), pp.362~363 (2024)