# An Intelligent Ensemble-Based Detection of In-Vehicle Network Intrusion
## 2 CAN's Background and Types of Attacks
### Attack Types
The attacker will inject high-frequency messages with a high priority that are either smaller than a normal message or have a CAN ID of 0x000. A malicious node can increase bus occupancy in order to cause delays or even prevent other communications. Figure 2 demonstrates an example of a DoS attack in which the attacker sends two messages with the high-priority CAN ID 0x000 to cause delays for the CAN ID 0x209 transmitted by ECU A.  
Fuzzing: The attacker injects random ID, DLC, and data fields while impersonating legitimate traffic using CAN IDs that appear legitimate to compromise the CAN bus system, causing disruptions such as shaking of the steering wheel, irregular signal lights, and automated gear shifts [37]. This attack approach involves sending many randomly compromised IDs and data into the network at any time, disrupting regular communications without the victim node's knowledge. The lack of authentication and data integrity in the CAN bus protocol led to this attack. Figure 3 shows an example of attacker-generated random messages with CAN IDs 0x200, 0x307, and 0x540, that are received by ECU B.  
Replay: The objective of this type of attack is to capture legitimate CAN messages in transmission and then later re-transmit them into the vulnerable CAN bus. This is an influential Man in the Middle attack that intercepts, records, and rebroadcasts network messages. This attack can result in actions that are not authorized or the dissemination of false information throughout the network. This type of attack occurs because the CAN bus data transmission is broadcast. An example of a replay attack is depicted in Figure 4, and it includes the attacker transmitting the CAN IDs that belong to the target ECUs, A and C, and are received by ECU B. \begin{table}
\begin{tabular}{c c c c c c} \hline
**Attack** & **Availability** & **Integrity** & **Authenticity** & **Non-Repudiation** & **Confidentiality** \\ \hline DoS [40] & + & & & & \\ \hline Fuzzing [41; 42] & + & + & & & \\ \hline Replay [43] & & + & + & + & + \\ \hline Spoofing [44] & & & + & + & \\ \hline \end{tabular}
\end{table} 
Table 1: Affected security requirements. Figure 2: DoS attack sends two messages with the high-priority CAN ID 0x000. Spoofing: The attacker is able to inject messages with specified CAN IDs belonging to authorized nodes, as no authentication is provided for communications on the CAN bus. Payload-focused spoofing is an attack where attackers intercept and analyze CAN communications to read and alter essential component structures. They quickly inject malicious information into transmission gaps by masquerading as a typical node with the same ID [46]. This attack has the possibility of reducing communication performance. Figure 5 demonstrates an example of a spoofing attack in which the attacker uses CAN ID 0x209, which belongs to ECU A, and sends it to the target ECU B. This attack has the potential to alter the frequency and the content of the targeted ID. Figure 4: Replay attack transmitting the CAN IDs that belong to the legitimate node. Figure 5: Spoofing attack injects messages with specified CAN IDs belonging to the authorized node. Figure 3: Fuzzing attack generated random messages with CAN IDs that appear as legitimate IDs.