LOCoCAT: Low-Overhead Classification of CAN Bus Attack Types

Despite research highlighting vulnerabilities and shortcomings of the controller area network bus (CAN bus) protocol and proposed alternatives, it remains the industry standard and is used in most vehicles. Much work has gone into detecting intrusions on the CAN bus because of its susceptibility to potential intruders who could impede execution or even take control of the vehicles. The majority of literature, however, does not offer defenses or responses to attacks, making it impossible for the system to operate securely in the face of an intrusion. This letter suggests a low-overhead approach to automatically identify and categorize intrusions into pre-established groups when they are found. Our framework consists of three steps: 1) classifies messages pertaining to the same attack into blocks; 2) extracts pertinent features from each block; and 3) uses a lightweight classifier model to predict the type of attack. Within the first 50 milliseconds of the attack, the initial models shown in this letter demonstrate an accuracy of up to 99.16%, enabling the system to respond to the intrusion before the malicious actor can complete their attack. This letter, in our opinion, establishes the framework for vehicles to respond differently at runtime depending on the kind of attack.