A Manipulated Overlapped Voltage Attack Detection Mechanism for Voltage-Based Vehicle Intrusion Detection System

To evade being detected by the content-based or frequency-based IDS, the attack model in the automotive CAN has shifted from the traditional packet flooding and payload modification attacks to stealth attacks such as shutdown attacks. These new types of stealth attacks are difficult to be effectively detected by content-based IDS and frequency-based IDS. The CAN bus physical voltage-based IDS can identify the source of each message and detect these stealth attacks effectively. However, the state of art research has discovered a novel masquerade attack called DUET, which can tamper with the existing voltage-based IDS by generating overlapping voltage signals with an accomplice to distort the fingerprint of the specified ECU. We propose a detection mechanism to prevent the manipulated voltage attacks of overlapping voltage signal samples, which is based on anomaly detection by applying the LSTM autoencoder model. By filtering the overlapped signal and rectifying the voltage fingerprint instance of the original voltage signal, the improved voltage-based IDS can effectively resist the DUET attack. Experiments demonstrated the proposed detection mechanism can authenticate the victim ECU and the accomplice ECU before and after the DUET two-stage attack, and prevent the receiver ECU from being deceived by the forged messages generated by the attacker and accomplice ECUs.