# An Intelligent Ensemble-Based Detection of In-Vehicle Network Intrusion
## 2 CAN's Background and Types of Attacks
### Attack Types  
The CAN protocol is limited by a lack of authentication and encryption as key security features. The lack of authentication causes violations of integrity and priority-based arbitration and exposes every node in the network to all transmitted messages. An attacker can exploit this vulnerability by launching a sniffing attack on the CAN bus, analyzing the internal CAN data of a target vehicle, and launching injection attacks to control the vehicle. The CAN protocol also gives priority to the arbitration mechanism. The protocol uses an ID-based priority scheme, which attackers can exploit by injecting high-priority messages to launch denial-of-service (DoS) attacks and prevent access to other services. The simplicity and high adaptability of the CAN protocol are vulnerabilities. This allows an attacker to inject deceptive data into the bus network [36; 37]. The authenticity of messages sent using the CAN protocol is also not guaranteed. As a message-based protocol, CAN sends messages without source or destination addresses since its frame format lacks sender/receiver information. Injection attacks are, therefore, easy to launch against the protocol. Such injection attacks typically exploit the onboard diagnostics II (OBD-II) interface to introduce malicious CAN messages into the vehicles and disable some functionalities. The attacks originate from internal sources such as the OBD or external sources such as Wi-Fi, cellular links, and Bluetooth devices [35; 38]. The lack of encryption, on the other hand, violates the principle of confidentiality. CAN is not encrypted because of real-time communication requirements. The risk of having no encryption is that attackers can launch malicious code to monitor all bus-broadcast communications, analyze their content, and use the information to hack the IVN. A compromised ECU can further take advantage of the broadcast property of CAN by monitoring and listening to all CAN frames or sending any frame across the network. CAN has security vulnerabilities that threaten the safety of vehicles, drivers, and passengers. The following are the security vulnerabilities in the CAN bus: Lack of Boundary Defense and Segmentation: The ECUs in IVNs are organized into sections, but these sections lack boundaries because gateways connect them. Therefore, a malicious user with access can take control of the system. Lack of Authentication: CAN has no authentication infrastructure, allowing any device to connect to the bus and join the network without the sender's ID being verified. Each node that joins the network may use CAN's broadcast communication feature to send malicious data to other nodes. Unencrypted Traffic: The messages exchanged between CAN nodes are in plain text, indicating that the protocol does not take the confidentiality requirement into account. Availability Check: Before allowing any message to be sent, the CAN protocols check to see if carriers are available. If any carrier is busy, the protocol prevents all ECUs from transmitting and rechecks the carriers after a certain period of time. This mechanism makes the protocol vulnerable to DoS attacks [15; 16; 18]. The authors in [39] evaluated classification techniques based on ML for the purpose of DoS detection. The implementation of machine learning techniques improved the performance of classification for detecting DoS attacks. Figure 1: The structure of a CAN packet frame. Attackers may target several security requirements in vehicular communication environments, including confidentiality, availability, authenticity, data integrity, and non-repudiation [40; 41; 42; 43; 44; 45]. Table 1 depicts the type of attack and the affected security requirements. Message injection attacks, including DoS, spoofing, replay, and fuzzing, are the most popular inter-vehicle attacks [41]. DoS: The attacker renders communication services unavailable by increasing the message frequency of the CAN bus.