A Practical Intrusion Detection and Defense Mechanism for In-Vehicle CAN Using Differential Voltage

다국어 초록 (Multilingual Abstract)

The In-Vehicle network consists of dozens of Electronic Control Units (ECUs) that communicate in real time to manage essential vehicle functions, most of which rely on the Controller Area Network (CAN) protocol. However, CAN was originally designed without fundamental security mechanisms such as transmitter authentication, encryption, and access control. As a result, it remains vulnerable to various attacks, including message replay and identifier monopolization. With the growing integration of external connectivity, these security threats have emerged as critical issues that may lead to severe accidents. Consequently, the demand for effective and practical defense mechanisms has significantly increased. This paper proposes a defense framework for strengthening the security of In-Vehicle CAN communication by exploiting the distinct characteristics of physical-layer signals. First, we introduce an ECU identification method that analyzes differential-voltage features arising from inherent hardware variations across ECUs. Unlike software-based approaches, this technique enables accurate recognition of ECU-specific electrical signal patterns using only a low-cost circuit, without requiring expensive measurement equipment or extensive training. The method demonstrates high identification accuracy against impersonation and replay attacks, thereby addressing the detection limitations of existing intrusion detection systems (IDSs). Second, we extend the concept of Moving Target Defense (MTD) to the physical layer of In-Vehicle communication and propose a dynamic obfuscation mechanism that periodically alters the differential voltage values used during CAN transmission. This approach prevents adversaries from persistently tracking or mimicking the electrical signal patterns of legitimate ECUs, thereby reducing system predictability and raising the difficulty of successful attacks. The proposed mechanism is compatible with existing CAN protocols and transceiver hardware, ensuring practical applicability without compromising real-time performance. To validate the feasibility and effectiveness of the proposed techniques, we implemented them on an experimental test-bed and conducted a series of performance evaluations. Metrics such as ECU identification accuracy, attack detection rate, false positive rate, and communication latency were measured and compared against conventional security solutions. The experimental results show that the proposed defense achieves superior detection performance against replay and impersonation attacks while maintaining system stability. Overall, this work presents a novel physical-layer-based security approach for automotive networks and is expected to contribute to the development of lightweight, multi-layered In-Vehicle security architectures.

목차 (Table of Contents)

• Ⅰ. Introduction 1
• 1.1 Research Background 1
• 1.2 Motivation 3
• 1.3 Contribution 5
• 1.4 Outline of Dissertation 8
• Ⅱ. Background 10
• 2.1 In-Vehicle Network Architecture and Characteristics 10
• 2.2 Security Vulnerability Analysis of CAN 27
• Ⅲ. Related Work 31
• 3.1 Hacking Incidents and Cyberattack Cases in CAN 31
• 3.2 Intrusion Detection Systems (IDS) for Automotive Networks 36
• 3.3 MTD–Based Automotive Security Techniques 40
• 3.4 Comparative Overview of CAN Defense Techniques 42
• Ⅳ. System and Security Model 45
• 4.1 System Model 45
• 4.2 Adversary Model 47
• 4.3 Scope of Attack type 49
• Ⅴ. Design of Differential-Voltage-Based ECU Characterization Method ·· 51
• 5.1 Analyzing Electrical Characteristics in CAN Transceivers 51
• 5.2 Design and Development of an ECU Identification Tool Using Differential Voltage 60
• Ⅵ. Moving Target Defense–Based CAN Security Mechanism 67
• 6.1 Allocation of differential voltage usage intervals 69
• 6.2 Assignment of Unique Physical-Layer Signatures to ECUs 72
• 6.3 Attack Detection 78
• 6.4 Deployment policy(Key Management) 80
• Ⅶ. Design and Evaluation of an Integrated Security Mechanism 81
• 7.1 Experimental environment 81
• 7.2 Verification Scenario 85
• 7.3 Experiment Results 87
• Ⅷ. Conclusion 90
• Reference 92