Detection of Abnormal CAN Messages Using Periodicity and Time Series Analysis 


Vol. 13,  No. 9, pp. 395-403, Sep.  2024
https://doi.org/10.3745/TKIPS.2024.13.9.395


PDF
  Abstract

Recently, with the advancement of technology, the automotive industry has seen an increase in network connectivity. CAN (Controller Area Network) bus technology enables fast and efficient data communication between various electronic devices and systems within a vehicle, providing a platform that integrates and manages a wide range of functions, from core systems to auxiliary features. However, this increased connectivity raises concerns about network security, as external attackers could potentially gain access to the automotive network, taking control of the vehicle or stealing personal information. This paper analyzed abnormal messages occurring in CAN and confirmed that message occurrence periodicity, frequency, and data changes are important factors in the detection of abnormal messages. Through DBC decoding, the specific meanings of CAN messages were interpreted. Based on this, a model for classifying abnormalities was proposed using the GRU model to analyze the periodicity and trend of message occurrences by measuring the difference (residual) between the predicted and actual messages occurring within a certain period as an abnormality metric. Additionally, for multi-class classification of attack techniques on abnormal messages, a Random Forest model was introduced as a multi-classifier using message occurrence frequency, periodicity, and residuals, achieving improved performance. This model achieved a high accuracy of over 99% in detecting abnormal messages and demonstrated superior performance compared to other existing models.

  Statistics
  Cite this article

[IEEE Style]

S. Kim, J. Sung, B. Youn, H. Cho, "Detection of Abnormal CAN Messages Using Periodicity and Time Series Analysis," The Transactions of the Korea Information Processing Society, vol. 13, no. 9, pp. 395-403, 2024. DOI: https://doi.org/10.3745/TKIPS.2024.13.9.395.

[ACM Style]

Se-Rin Kim, Ji-Hyun Sung, Beom-Heon Youn, and Harksu Cho. 2024. Detection of Abnormal CAN Messages Using Periodicity and Time Series Analysis. The Transactions of the Korea Information Processing Society, 13, 9, (2024), 395-403. DOI: https://doi.org/10.3745/TKIPS.2024.13.9.395.

Forms

Search
(IN TITLE, AUTHOR, ABSTRACT,KEYWORDS)

Advanced Search ▼

POPULAR KEYWORDS
(TOP 10 KEYWORDS)

Recent Publications
(LAST 3 YEARS)

Old Journals

Indexing

All publications of TKIPS is indexed in DOI, EBSCO, Google Scholar, Crossref, and CrossCheck.

TKIPS is also selected as the Journal for Accreditation by NRF (National Research Foundation of Korea).

Related Journals