# Prevention of Controller Area Network (CAN) Attacks on Electric Autonomous Vehicles
## 3 CAN Bus Attack Mitigation Schemes
The authors of [15] developed a system that identifies the ECUs connected to the CAN bus and detects if a malicious ECU has been added to the bus. The developed system connects a monitoring unit that observes the signal profile of the network and sends an alarm when a malicious ECU is detected. The developed detection system is useful in detecting CAN bus attacks performed through the attack path of adding a maliciousECU, but it cannot detect attacks carried out through injecting a malicious code into an existing ECU. A novel intrusion detection system called CANintelliIDS was developed to identify CAN bus single intrusion and mixed intrusion attacks [16]. CANintelliIDS uses a combination of attention-based gated recurrent unit (GRU) and convolutional neural network (CNN) to analyze the timing behavior of the CAN bus traffic. CANintelliIDS is able to detect DoS attacks, fuzzing attacks, and ECU impersonation attacks. A combination of CNN- and LSTM-based deep learning models was used to develop a novel intrusion detection system, called NovelADS [17], which is capable of detecting four types of attacks: fuzzing attacks, RPM spoofing attacks, gear spoofing attacks, and DoS attacks. Since NovelADS is trained using unsupervised learning, it can effectively identify zero-day attacks. The authors of [18] developed a multiple-observation hidden Markov model (HMM) that is able to detect the anomaly of a single frame rather than over a time period. The multi-observation HMM model observes the timing characteristics of the CAN bus and the messages' identifier (ID) sequence to calculate the existence possibility of a CAN frame. This approach is proven to have a better frame-by-frame anomaly detection performance than the other approaches studied in the literature in detecting fuzzing attacks, DoS attacks, replay attacks, and ECU impersonation. A novel intrusion detection system that is based on attention mechanisms and a developed autoencoder is proven to be able to detect CAN bus attacks in real time and to outperform traditional machine learning algorithms [19]. The attention mechanism and autoencoder for intrusion detection (AMAEID) algorithm uses the autoencoder to decode a CAN message into a binary format and to detect the hidden feature representation. Then, the attention mechanism with the aid of a single-layer connected network outputs a prediction of whether the message is normal or abnormal. To overcome communication latency and possible privacy breaches that may occur in IDS that use centralized learning approaches, the usage of federated-learning approaches has been further investigated by the literature. The research conducted in [20] developed a federated long short-term memory (LSTM)-based intrusion detection system. The federated LSTM is able to detect attacks such as DoS, drop, replay, and spoofing attacks, with an accuracy of over 90%. The usage of federated LSTM overcomes the limitations of deep neural network (DNN) algorithms, such as the need for a centralized cloud server model training which can lead to privacy data leak. The proposed federated LSTM algorithm monitors messages' identifier sequence, predicts the upcoming message's ID, and detects if an abnormal message is sent through the bus. Another example of an intrusion detection system that uses federated learning is the ImageFed privacy-preserving intrusion detection system [21], which uses a federated CNN model to detect attacks such as fuzzing, gear spoofing, RPM spoofing, and DoS attacks. Current state-of-the-art intrusion detection systems can detect abnormal message frames with a high frequency, but there exist some limitations to current CAN bus IDSs. Firstly, most IDSs do not provide mitigation or prevention schemes and are limited to just detecting and reporting abnormal frames. Secondly, current IDSs cannot detect all CAN bus attacks, such as sniffing attacks which are not detected nor prevented by IDSs. Thirdly, some IDSs fail to detect CAN messages with minor deviation and abnormality [19].