Controller Area Network (CAN) is an in-vehicle communication protocol, which provides an efficient and reliable communication link between Electronic Control Units (ECUs) in real time. Recent studies have shown that attackers can take remote control of the targeted vehicle by exploiting the vulnerabilities of the CAN protocol. Motivated by this fact, we propose an Intrusion Detection System (IDS), called Clock Offset-based IDS (COIDS), to monitor in-vehicle network activities to detect any intrusion. Precisely, COIDS measures and then exploits the clock offset of transmitter ECU's clock for fingerprinting ECU. COIDS next leverages the derived fingerprints to construct a baseline of ECU's normal clock behavior using an active learning technique. Based on the baseline of normal behavior, COIDS uses the Cumulative Sum method to detect any abnormal deviation in clock offset. Further, COIDS uses a sequential change-point detection technique to determine the exact time of intrusion. Generally, COIDS has to run on every ECU to monitor the network behavior. This can turn out to be a significant power overhead for a hardware-constrained ECU. Thus, we next develop a cooperative game model to optimize the active time duration of COIDS in an ECU. We performed exhaustive experiments on real world publicly available datasets primarily to assess the effectiveness of COIDS against a wide range of in-vehicle network attacks. Our results show that COIDS detects intrusions faster than the best performed IDS in the state-of-the-art. Further, the results show that our designed cooperative game model significantly reduces the power overhead of the ECU without compromising the performance.

Modern cyber-physical systems are becoming increasingly interdependent. Such interdependencies create new vulnerabilities and make these systems more susceptible to failures. In particular, failures can easily spread across these systems, possibly causing cascade effects with a devastating impact on their functionalities. In this paper, we focus on the interdependence between the power grid and the communications network, and propose a novel realistic model, called HINT (Heterogeneous Interdependent NeTworks), to study the evolution of cascading failures. Our model takes into account the heterogeneity of such networks as well as their complex interdependencies. We use HINT to train machine learning methods based on novel features for predicting the effects of the cascading failures. Additionally, by using feature selection, we identify the most important features that characterize critical nodes. We compare HINT with two previously proposed models both on synthetic and real network topologies. Experimental results show that existing models oversimplify the failure evolution and network functionality requirements. In addition, the machine learning approaches accurately forecast the effects of the failure propagation in the considered scenarios. Finally, we show that by strengthening few critical nodes identified by the proposed features, we can greatly improve the network robustness.

Controller Area Network (CAN) is an in-vehicle communication protocol which provides an efficient and reliable communication link between Electronic Control Units (ECUs) in real-time. Recent studies have shown that attackers can take remote control of the targeted car by exploiting the vulnerabilities of the CAN protocol. Motivated by this fact, we propose Clock Offset-based Intrusion Detection System (COIDS) to monitor in-vehicle network and detect any intrusion. Precisely, we first measure and then exploit the clock offset of transmitter ECU's clock for fingerprinting ECU. We next leverage the derived fingerprints to construct a baseline of ECU's normal clock behaviour using an active learning technique. Based on the baseline of normal behaviour, we use Cumulative Sum method to detect any abnormal deviation in clock offset. Particularly, if the deviation in clock offset exceeds an unexpected positive or negative value, COIDS declares this change as an intrusion. Further, we use sequential change-point detection technique to determine the exact time of intrusion. We perform exhaustive experiments on real-world publicly available datasets primarily to assess the effectiveness of COIDS against three most potential attacks on CAN, i.e., DoS, impersonation and fuzzy attacks. The results show that COIDS is highly effective in defending all these three attacks. Further, the results show that COIDS considerably faster in detecting intrusion compared to a state-of-the-art solution.