基于帧间隔-总线电压混合特征的汽车 ECU 伪装攻击识别

The development of networking and intelligence in automobiles has intensified the intrusion risk of automotive CAN(Controller Aera Network). Unlike Ethernet networks with well-established identity authentication mechanisms and encrypted transmission protocols, CAN bus adopts the plaintext means of data, making the messages easily stolen and attacked by illegal ECUs. Therefore, how to design an onboard intrusion detection system (IDS)to identify illegal tampering and disguise attacks has become a key and difficult issue. Accordingly, an automotive ECU camouflage attack recognition technology based on frame interval and bus voltage hybrid feature extraction is proposed in this paper. Firstly, the frame intervals of the message frame are obtained using the timestamp mechanism of the embedded device. Meanwhile, voltage signals of the automotive bus network are sampled, and the characteristic parameters of the bus voltage(such as voltage mode and edge time)are obtained using fast signal processing technology. Thus, the hybrid features including the frame intervals, voltage modes, bit time, edge time are formulated to construct the ECU fingerprints. Then, the lightweight Softmax learning algorithm is used to train the IDS model and identify potential illegal intrusion behaviors such as disguised attacks online. In order to verify the effectiveness of the proposed method, hardware experiments based on ECU devices are conducted in this paper, and the results show that the recognition accuracy of the proposed method for all ECUs is as high as 98.33%, with illegal intrusion identified by the sources of messages. Compared to traditional methods based on single feature fingerprints, the method proposed in this article can improve recognition accuracy by about 7%.