In-Vehicle ECU Identification and Intrusion Detection from Electrical Signaling

The chapter considers the problem of Electronic Control Unit (ECU) identification from signal characteristics at the physical layers of in-vehicle Controller Area Network (CAN) and in-vehicle CAN-FD (CAN with flexible data rate) network. IDSs from in-vehicle CAN data frames (in prior chapter) have been found useful in detecting anomaly, however, they cannot determine which ECU launches the particular attacks. This chapter describes the IDS approaches that can not only detect the presence of malicious frames but also identify their sender ECUs. This is very essential for fast forensic, isolation, security patch, etc. The strategy counts on CAN signals’ unique characteristics of CAN physical layer, e.g., the hardware and CAN topology information (delineated by the signals characteristics) so that even if two ECUs send identical CAN messages, corresponding signals are divergent.