# Prevention of Controller Area Network (CAN) Attacks on Electric Autonomous Vehicles
## 3 CAN Bus Attack Mitigation Schemes  
Detecting and preventing CAN bus attacks has been a field of interest in academia, leading to the development of several detection and prevention schemes. These detection and prevention schemes are classified into cryptography-based encryption and authentication schemes, and intrusion detection systems. Cryptography-based schemes ensure CAN messages' confidentiality by applying cryptographic encryption algorithms and ensure these messages' integrity and authenticity by using message authentication codes (MACs) and digital signatures [11]. Ref. [12] proposed the usage of a 128-bit advanced encryption standard (AES-128) to encrypt CAN messages at the sender node and then decrypt the messages at the receiver node. This protects the network against sniffing attacks, as an eavesdropper will gain access to the encrypted messages without knowledge of the used key. Hence, the attacker will not be able to decipher the content of the messages. The usage of encryption algorithms also prevents injection attacks and ECU impersonation, as an attacker who does not have access to the used key cannot send targeted falsified messages to the receiver nodes, who expect the received messages to be encrypted. Although encryption algorithms ensure the confidentiality of transmitted messages, they do not guarantee the authenticity of these messages' sources. Therefore, encryption algorithms cannot be used to protect against attacks such as fuzzing attacks. Also, encryption algorithms cannot protect against injection attacks and ECU impersonation if an attacker has access to the encryption key, which could be achieved by injecting a malicious code into an ECU that has knowledge of the encryption key. This limitation is addressed through the usage of message authentication codes and digital signatures that can be used to verify the authenticity of the messages' sources. The authors of [13] suggested replacing the cyclic redundancy check (CRC) field in the CAN frame with cipher-block chaining (CBC) MAC, which is generated by the sender node and verified at the receiver node using a key that is only shared between the two nodes. Although cryptographic encryption and authenticity schemes provide preventive algorithms to CAN bus attacks, they possess multiple limitations. Firstly, cryptographic encryption algorithms require a change to all CAN bus nodes because all nodes should be able to decrypt and encrypt messages. Secondly, the usage of cryptographic algorithms increases message latency because of the extra computations performed for each message. This delay can be decreased through the usage of cryptographic hardware accelerators but at a large cost of implementation. Thirdly, some cryptographic algorithms, such as MACs and digital signatures, require changes to the CAN bus behavior to include the added verification tags. Finally, the strength of cryptographic algorithms relies on the secrecy of the used key, which is vulnerable because it is shared between the system's ECUs. Intrusion detection systems use machine learning and deep learning algorithms to detect the presence of malicious messages in the CAN bus. Intrusion detection systems are classified into signature-based IDSs and anomaly-based IDSs. Signature-based IDSs use a database of CAN bus attacks to extract the signature of each attack and use these signatures to detect malicious behavior in the bus. Although signature-based IDSs have a high prediction rate of attacks, they require a continuous update of the database to be able to detect new attacks [14]. Anomaly-based IDSs use learning models to monitor the CAN traffic behavior and the CAN physical characteristics and to identify abnormal behavior or characteristics [2]. Anomaly-based IDSs monitor traffic behavior such as message frequency, message payload, and message identifiers, and monitor physical characteristics such as voltage and signal profiles. The study and development of CAN IDSs has been extensively investigated in the literature.