
@article {EzeOlu20A,
	title = {Reverse Engineering Controller Area Network Messages using Unsupervised Machine Learning},
	journal = {IEEE Consumer Electronics Magazine},
	volume = {11},
	year = {2022},
	month = {January},
	abstract = {<p>The smart city landscape is rife with opportunities for mobility and economic optimization, but also presents many security concerns spanning the range of components and systems in the smart ecosystem. One key enabler for this ecosystem is smart transportation and transit, which is foundationally built upon connected vehicles. Ensuring vehicular security, while necessary to guarantee passenger and pedestrian safety, is itself challenging due to the broad attack surfaces of modern automotive systems. A single car contains dozens to hundreds of small embedded computing devices known as electronic control units (ECUs) executing 100s of millions of lines of code; the inherent complexity of this tightly-integrated cyber-physical system (CPS) is one of the key problems that frustrates effective security. We describe an approach to help reduce the complexity of security analyses by leveraging unsupervised machine learning to learn clusters of messages passed between ECUs that correlate with changes in the CPS state of a vehicle as it moves through the world. Our approach can help to improve the security of vehicles in a smart city, and can leverage smart city infrastructure to further enrich and refine the quality of the machine learning output.</p>
},
	author = {Uchenna Ezeobi and Habeeb Olufowobi and Clinton Young and Joseph Zambreno and Gedare Bloom}
}
@article {OluYou19A,
	title = {SAIDuCANT: Specification-based Automotive Intrusion Detection using Controller Area Network (CAN) Timing},
	journal = {IEEE Transactions on Vehicular Technology},
	volume = {69},
	year = {2020},
	month = {February},
	abstract = {The proliferation of embedded devices in modern vehicles has opened the traditionally-closed vehicular system to the risk of cybersecurity attacks through physical and remote access to the in-vehicle network such as the controller area network (CAN). The CAN bus does not implement a security protocol that can protect the vehicle against the increasing cyber and physical attacks. To address this risk, we introduce a novel algorithm to extract the real-time model parameters of the CAN bus and develop SAIDuCANT, a specification-based intrusion detection system (IDS) using anomaly-based supervised learning with the real-time model as input.We evaluate the effectiveness of SAIDuCANT with real CAN logs collected from two passenger cars and on an open source CAN dataset collected from real-world scenarios. Experimental results show that SAIDuCANT can effectively detect data injection attacks with low false positive rates and outperforms other detection approaches using the timing features of CAN messages.},
	author = {Habeeb Olufowobi and Clinton Young and Joseph Zambreno and Gedare Bloom}
}
@conference {YouSvo20A,
	title = {Towards Reverse Engineering Controller Area Network Messages Using Machine Learning},
	booktitle = {Proceedings of the IEEE World Forum on Internet of Things (WF-IoT)},
	year = {2020},
	month = {April},
	abstract = {The automotive Controller Area Network (CAN) allows Electronic Control Units (ECUs) to communicate with each other and control various vehicular functions such as engine and braking control. Consequently CAN and ECUs are high priority targets for hackers. As CAN implementation details are held as proprietary information by vehicle manufacturers, it can be challenging to decode and correlate CAN messages to specific vehicle operations. To understand the precise meanings of CAN messages, reverse engineering techniques that are time-consuming, manually intensive, and require a physical vehicle are typically used. This work aims to address the process of reverse engineering CAN messages for their functionality by creating a machine learning classifier that analyzes messages and determines their relationship to other messages and vehicular functions. Our work examines CAN traffic of different vehicles and standards to show that it can be applied to a wide arrangement of vehicles. The results show that the function of CAN messages can be determined without the need to manually reverse engineer a physical vehicle.  },
	author = {Clinton Young and Jordan Svoboda and Joseph Zambreno}
}
@conference {OluEze19A,
	title = {Anomaly Detection Approach Using Adaptive Cumulative Sum Algorithm for Controller Area Network},
	booktitle = {Proceedings of the ACM Workshop on Automotive Cybersecurity (AutoSec)},
	year = {2019},
	month = {March},
	abstract = {The modern vehicle has transformed from a purely mechanical system to a system that embeds several electronic devices. These devices communicate through the in-vehicle network for enhanced safety and comfort but are vulnerable to cyber-physical risks and attacks. A well-known technique of detecting these attacks and unusual events is by using intrusion detection systems. Anomalies in the network occur at unknown points and produce abrupt changes in the statistical features of the message stream. In this paper, we propose an anomaly-based intrusion detection approach using the cumulative sum (CUSUM) change-point detection algorithm to detect data injection attacks on the controller area network (CAN) bus. We leverage the parameters required for the change-point algorithm to reduce false alarm rate and detection delay. Using real dataset generated from a car in normal operation, we evaluate our detection approach on three different kinds of attack scenarios.},
	author = {Habeeb Olufowobi and Uchenna Ezeobi and Eric Muhati and Gaylon Robinson and Clinton Young and Joseph Zambreno and Gedare Bloom}
}
@conference {YouOlu19A,
	title = {Automotive Intrusion Detection Based on Constant CAN Message Frequencies Across Vehicle Driving Modes},
	booktitle = {Proceedings of the ACM Workshop on Automotive Cybersecurity (AutoSec)},
	year = {2019},
	month = {March},
	abstract = {The modern automobile relies on numerous electronic control units communicating over the de facto standard of the controller area network (CAN) bus. This communication network was not developed with cybersecurity in mind. Many methods based on constant time intervals between messages have been proposed to address this lack of security issue with the CAN bus. However, these existing methods may struggle to handle variable time intervals between messages during transitions of vehicle driving modes. This paper proposes a simple and cost-effective method to ensure the security of the CAN bus that is based on constant message frequencies across vehicle driving modes. This proposed method does not require any modifications on the existing CAN bus and it is designed with the intent for efficient execution in platforms with very limited computational resources. Test results with the proposed method against two different vehicles and a frequency domain analysis are also presented in the paper.},
	author = {Clinton Young and Habeeb Olufowobi and Gedare Bloom and Joseph Zambreno}
}
@article {YouOlu19B,
	title = {Survey of Automotive Controller Area Network Intrusion Detection Systems},
	journal = {IEEE Design and Test},
	volume = {36},
	year = {2019},
	month = {December},
	abstract = {Control Area Network (CAN) is one of the most popular targets for malicious attacks and exploitations in modern automotive systems. The goal of intrusion detection systems (IDS) is to identify and mitigate security attacks; consequently, they are of paramount importance to automotive security. This article surveys the state of the art in IDS, with special emphasis on techniques for detecting attacks on CAN modules.},
	author = {Clinton Young and Habeeb Olufowobi and Gedare Bloom and Joseph Zambreno}
}
@conference {OluBlo18A,
	title = {Work-in-Progress: Real-Time Modeling for Intrusion Detection in Automotive Controller Area Network},
	booktitle = {Proceedings of the IEEE Real-Time Systems Symposium (RTSS)},
	year = {2018},
	month = {December},
	abstract = {Security of vehicular networks has often been an afterthought since they are designed traditionally to be a closed system. An attack could lead to catastrophic effect which may include loss of human life or severe injury to the driver and passengers of the vehicle. In this paper, we propose a novel algorithm to extract the real-time model of the controller area network (CAN) and develop a specification-based intrusion detection system (IDS) using anomaly-based supervised learning with the real-time model as input. We evaluate IDS performance with real CAN logs collected from a sedan car.},
	author = {Habeeb Olufowobi and Gedare Bloom and Clinton Young and Joseph Zambreno}
}
@conference {YouZam16A,
	title = {Towards a Fail-Operational Intrusion Detection System for In-Vehicle Networks},
	booktitle = {Proceedings of the Workshop on Security and Dependability of Critical Embedded Real-Time Systems (CERTS)},
	year = {2016},
	month = {November},
	abstract = {The landscape of automotive in-vehicle networks is changing driven by the vast options for infotainment features and progress toward fully-autonomous vehicles. However, the security of automotive networks is lagging behind feature-driven technologies, and new vulnerabilities are constantly being discovered. In this paper, we introduce a road map towards a security solution for in-vehicle networks that can detect anomalous and failed states of the network and adaptively respond in real-time to maintain a fail-operational system.},
	author = {Clinton Young and Joseph Zambreno and Gedare Bloom}
}
@article {SunYan09A,
	title = {Demonstrable Differential Power Analysis Attacks on Real-World FPGA-Based Embedded Systems},
	journal = {Integrated Computer-Aided Engineering},
	volume = {16},
	number = {2},
	year = {2009},
	month = {April},
	pages = {119-130},
	abstract = {In the decade since the concept was publicly introduced, power analysis attacks on cryptographic systems have become an increasingly studied topic in the computer security community. Research into countermeasures for these cryptographic systems has intensified as well. Experiments have been conducted showing the potential effectiveness of power analysis attacks and preventative techniques on both software (e.g. smartcard, DSP) and hardware (e.g. ASIC, FPGA) processing elements. One key observation that motivates our work is that the majority of the research into power analysis on FPGA-based cryptographic systems has been a) theoretical in nature, b) evaluated through simulation, or c) experimented using custom hardware that does not closely mirror real-world systems. In this paper, we look to bridge this gap between theory and practice by detailing our experience in performing a Differential Power Analysis (DPA) attack on a commercial FPGA development board. We present an automated data acquisition and analysis design for an FPGA-based implementation of the Data Encryption Standard (DES), and discuss some of the challenges and obstacles that we encountered when performing the DPA attack on our chosen commercial platform.},
	author = {Song Sun and Jackey Yan and Joseph Zambreno}
}
@conference {SunYan08A,
	title = {Experiments in Attacking FPGA-Based Embedded Systems using Differential Power Analysis},
	booktitle = {Proceedings of the IEEE International Conference on Electro/Information Technology (EIT)},
	year = {2008},
	month = {May},
	abstract = {In the decade since the concept was publicly introduced, power analysis attacks on cryptographic systems have become an increasingly studied topic in the computer security community. Research into countermeasures for these cryptographic systems has intensified as well. Experiments have been conducted showing the potential effectiveness of power analysis attacks and preventative techniques on both software (e.g. smartcard, DSP) and hardware (e.g. ASIC, FPGA) processing elements. One key observation that motivates our work is that the majority of the research into power analysis on FPGA-based cryptographic systems has been a) theoretical in nature, b) evaluated through simulation, or c) experimented using custom hardware that does not closely mirror real-world systems. In this paper, we look to bridge this gap between theory and practice by detailing our experience in performing a Differential Power Analysis (DPA) attack on a commercial FPGA development board. We present an automated data acquisition and analysis design for an FPGA-based implementation of the Data Encryption Standard (DES), and discuss some of the challenges and obstacles that we encountered when performing the DPA attack on our chosen commercial platform.},
	author = {Song Sun and Jackey Yan and Joseph Zambreno}
}
