Exploiting TemperatureVaried ECU Fingerprints for Source Identification in Invehicle Network Intrusion Detection The invehicle controller area network(CAN) provides reliable communications among ECUs, whereas the lack of security design of CAN protocols makes it vulnerable to CAN targeting attacks. Unfortunately, existing CAN intrusion detection systems merely recognize fabricated CAN messages while only little work are devoted to intrusion source identification. Demonstrated by our experimental study, the stateoftheart source ECU identification approaches, which are based on physical ECU fingerprints, will fail when ECU temperature varies. In this paper, we innovatively propose temperaturevaried fingerprinting, called TVF, for CAN intrusion detection and source ECU identification. Inspired by the significant observation that the clock offset of a specific ECU, i.e., its fingerprint, varies with the environment temperature of the ECU, the concept of temperaturevaried ECU fingerprints are proposed and exploited to improve source identification accuracy in realworld vehicle CAN intrusion cases. The proposed temperaturevaried fingerprinting is implemented and extensive performance evaluation experiments are conducted in both CAN bus prototype and real vehicles. The experimental results demonstrate the efficacy of the proposed TVF.

Evaluation Framework for Network Intrusion Detection Systems for InVehicle CAN Modern vehicles are complex safety critical cyber physical systems, that are connected to the outside world, with all security implications it brings. Different network intrusion detection systems (NIDSs) proposed for the CAN bus, the predominant type of invehicle network, to improve security are hard to compare due to disparate evaluation methods adopted. In this paper we provide the means to compare CAN NIDSs on equal footing and evaluate the ones detailed in the literature. Based on this we observe some limitation of existing approaches and why in the CAN setting it is intrinsically difficult to distinguish benign from malicious payload. We argue that xe2x80x9cmeaningawarexe2x80x9d detection (a concept we define) which is challenging (but perhaps not impossible) to create for this setting.