To address the high computational cost of feature extraction from CAN bus voltage signals of anomaly detection, the paper introduces a method that generates node-specific hardware fingerprints by extracting distinctive voltage subsequences, accurately capture the unique hardware characteristics of nodes. Furthermore, an anomaly detection model using a Long Short-Term Memory (LSTM) network for time series prediction is proposed, which effectively identifies the source nodes of CAN frames, detects anomalous frames, and discriminates attacks initiated by malicious or unauthorized nodes. Evaluations demonstrated that the proposed approach achieves a source identification accuracy of 99.10% in actual vehicles and 99.88% under low sampling rates in the prototype. Comparative results indicate that the method not only outperforms existing advanced techniques but also offers benefits such as low computational overhead and a reduced false positive rate, highlighting its strong practical applicability and potential for widespread adoption.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

A CAN Bus Anomaly Detection Method Based on Time Series Prediction

  • Weiping Yao,
  • Qingbao Li,
  • Zhifeng Chen,
  • Bocheng Xu

摘要

To address the high computational cost of feature extraction from CAN bus voltage signals of anomaly detection, the paper introduces a method that generates node-specific hardware fingerprints by extracting distinctive voltage subsequences, accurately capture the unique hardware characteristics of nodes. Furthermore, an anomaly detection model using a Long Short-Term Memory (LSTM) network for time series prediction is proposed, which effectively identifies the source nodes of CAN frames, detects anomalous frames, and discriminates attacks initiated by malicious or unauthorized nodes. Evaluations demonstrated that the proposed approach achieves a source identification accuracy of 99.10% in actual vehicles and 99.88% under low sampling rates in the prototype. Comparative results indicate that the method not only outperforms existing advanced techniques but also offers benefits such as low computational overhead and a reduced false positive rate, highlighting its strong practical applicability and potential for widespread adoption.