Enhancing Intrusion Detection in Controller Area Networks

• •TISIC improves detection of CAN attacks by redefining inter-message arrival times.
• •The CAN bus is vulnerable due to its design for reliability over security.
• •Public datasets validate the effectiveness of the new detection method.

Recent advancements in intrusion detection for Controller Area Networks (CAN) have been reported, focusing on time-based detection methods for timing transparent attacks. The conventional definition of inter-message arrival times has been shown to degrade detection performance due to attack messages influencing reference times. A new approach, TISIC, has been proposed to improve detection accuracy by preserving normal reference times even during attacks. This method was validated using publicly available datasets, including the Car-Hacking Dataset and X-CANIDS dataset, demonstrating enhanced detection metrics such as AUROC and AUPR. The CAN bus, widely used in modern vehicles, remains vulnerable due to its lack of built-in security features, exposing it to various attack vectors. The research emphasizes the growing need for robust intrusion detection systems as the attack surface for vehicles expands with new technologies. This development is timely, given the increasing regulatory focus on automotive cybersecurity.