can-logic: Automotive Intrusion Detection via Temporal Logic
Brooke Lampe, Weizhi Meng · 2023
The controller area network (CAN) protocol is all but synonymous with the terms “automotive network" or “in-vehicle network." Nearly all modern vehicles leverage one or more controller area networks to facilitate intra-vehicle communications. Unfortunately, the CAN bus is inherently insecure and severely resource-constrained. As such, researchers, industry experts, and legislators have been hard-pressed to improve the security of the CAN bus. Automotive intrusion detection has been propounded in the literature as a lightweight CAN bus security solution. Automotive intrusion detection systems (IDSs) can solve many of the resource-related challenges of CAN bus security; unfortunately, they still fall short in terms of practicability. An IDS capable of successfully detecting attacks will inevitably raise some false positives. When it comes to in-vehicle networks, even a relatively low false positive rate, e.g., 0.0001, would still produce approximately 100 false positives every 1,000,000 messages—that is, every five to ten minutes. Needless to say, such an IDS would not be practicable.