Using Sensor Redundancy in Vehicles and Smartphones for Driving Security and Safety by Arunkumaar Ganesan A dissertation submitted in partial fulfillment of the requirements for the degree of Doctor of Philosophy (Computer Science and Engineering) in The University of Michigan 2020 Doctoral Committee: Professor Kang G. Shin, Chair Professor Alex Halderman Research Professor Peter Honeyman Associate Professor Gabor Orosz Arunkumaar Ganesan [email protected] ORCID iD: 0000-0002-4137-1911 c Arunkumaar Ganesan 2020 All Rights Reserved to my wife and my family ii ACKNOWLEDGEMENTS This PhD is not my own accomplishment. It is made possible by all those who supported me, gave me confidence, and helped create a nurturing environment where new ideas can grow and thrive. First and foremost I am thankful for my advisor. Prof. Kang Shin had the dif- ficult job of watching me repeatedly switch between different research topics before he guided my attention towards the topic which eventually became this dissertation. Prof. Shin generously gives his time and energy to each of his students and collabo- rators. I also want to thank my committee members for helping refine my thesis and research. I am thankful for my lab members. Doing a PhD has many ups and downs. Sharing it with others who are undergoing the same experiences helped me persevere and come out victorious. I am humbled by their intelligence, hard work and creativity. Specifically I would like to thank Kassem Fawaz, Huan Feng, Yu-Chih Tung, Dongyao Chen, and Kyu-Suk Han for joining me on this journey and being the source of many new ideas. I am grateful for the unconditional support and sometimes stern guidance of my family. Doing a PhD is hard but it would have been much harder if my family wasn't always available providing silent moral support. Finally, I am incredibly thankful for my wife. Evie has been a permanent source of support and inspiration for all the years we've known each other. Her warm and kind support has helped me through the hardest moments of my degree and encouraged me to keep pushing. iii This thesis research has been supported in part by National Science Foundation under Grant CNS-1646130, University of Michigan MCity Program as well as Ford{ UM Alliance Program. iv TABLE OF CONTENTS DEDICATION :::::::::::::::::::::::::::::::::: ii ACKNOWLEDGEMENTS :::::::::::::::::::::::::: iii LIST OF FIGURES ::::::::::::::::::::::::::::::: ix LIST OF TABLES :::::::::::::::::::::::::::::::: xiv ABSTRACT ::::::::::::::::::::::::::::::::::: xvi CHAPTER I. Introduction ..............................1 1.1 Background . .1 1.2 CAN-bus Injection . .2 1.2.1 CAN-bus Traffic Monitoring . .2 1.2.2 Additional Hardware . .3 1.2.3 Modeling Specific Subsystems . .3 1.3 Detecting Stationary and Mobile Driving Hazards . .4 1.4 Vehicular Data Collection Platforms . .5 1.4.1 Specialized Data Collection . .5 1.4.2 General Data Collection . .6 1.4.3 Reusable Data Collection Platforms . .6 1.5 Thesis Contributions . .7 1.5.1 Exploratory Analysis of OBD-Sensor Redundancy .7 1.5.2 CarSec: Using Smartphones as Car Security Assistants8 1.5.3 Ubi: Using GPS Trajectories to Detect Driving Hazards9 1.5.4 CAB: On-Demand Vehicular Data Collection Builder 10 II. Exploration in Leveraging OBD-Sensor Redundancy Within and Across Vehicles .......................... 12 2.1 Introduction . 12 v 2.1.1 IVBSS Dataset . 12 2.1.2 Exploratory Methods Overview . 13 2.2 Related Work . 15 2.2.1 In-vehicle Sensor Relationships . 15 2.2.2 Across-vehicle Road-Level Anomalies . 16 2.3 Exploratory Methods . 17 2.3.1 In-Vehicle: Correlation . 17 2.3.2 Across-Vehicles: PCA and CA . 18 2.3.3 Principal Component Analysis (PCA) . 19 2.3.4 Cluster Analysis (CA) . 21 2.4 Findings: In-Vehicle . 25 2.4.1 Across-Trip Consistency . 25 2.4.2 Vehicle- and Driver-Specific Models . 27 2.4.3 Within-Trip Consistency . 28 2.4.4 Hypothesis: Contextual Factors . 29 2.4.5 Cluster analysis . 30 2.4.6 Variation within each cluster . 33 2.4.7 Detecting CAN-bus Injection Attacks . 34 2.5 Findings: Across-Vehicles . 36 2.5.1 Observations . 36 2.5.2 Detecting Abnormal Cases . 37 2.5.3 Novel Anomalous Discoveries . 39 2.6 Conclusion . 40 III. CarSec: Using Smartphones as Car Security Assistants .... 43 3.1 Introduction . 43 3.2 Related Work . 47 3.2.1 Phone-based Estimation of Vehicular Sensors . 47 3.2.2 Vehicular Intrusion Detection Systems (IDS) . 48 3.3 Background and Threat Model . 49 3.3.1 Why Smartphones? . 50 3.3.2 Adversary Model . 51 3.4 System Model . 52 3.4.1 Speed . 54 3.4.2 Steering Wheel Angle . 55 3.4.3 Fuel Level . 56 3.4.4 Gear Position . 56 3.4.5 Engine RPM . 57 3.5 Evaluation . 57 3.5.1 Evaluation Dataset . 58 3.5.2 Estimation Accuracy . 58 3.5.3 Sensor-Falsification Detection Accuracy . 66 3.5.4 Android Implementation and Evaluation . 73 3.6 Discussion . 76 vi 3.7 Conclusion . 77 IV. Ubi: Using GPS Trajectories to Detect Driving Hazards ... 79 4.1 Introduction . 79 4.1.1 State-of-the-Art . 79 4.1.2 Proposed Solution . 80 4.1.3 Ubi Operation . 81 4.1.4 Key Technical Details . 81 4.1.5 Results . 82 4.1.6 Contributions . 82 4.1.7 Outline . 82 4.2 Related Work . 83 4.2.1 Direct: Hazard Detection . 83 4.2.2 Indirect: Detection based on GPS trajectories . 84 4.2.3 Graph-based anomaly detection . 84 4.2.4 Crowd-sourced detection . 85 4.3 System Design . 86 4.3.1 Ubi System Input Output . 88 4.3.2 Graph Search . 88 4.3.3 Using graph search to warn drivers . 93 4.4 Evaluation . 93 4.4.1 Evaluation of the Warning System . 93 4.4.2 Evaluation of Graph Search . 98 4.5 Discussion and Future Work . 103 4.6 Conclusion . 104 V. CAB: On-demand Vehicular Data Collection Builder ...... 105 5.1 Introduction . 105 5.1.1 State of the Art . 106 5.1.2 Proposed System: CAB . 107 5.1.3 Key Technical Details . 107 5.1.4 Results . 109 5.1.5 Contributions . 109 5.2 Data-Collection Requirements . 110 5.2.1 Design Goals . 111 5.3 System . 112 5.3.1 Algorithm Developer . 113 5.3.2 App Designer . 115 5.3.3 Experiment Participant . 119 5.4 Implementation . 120 5.5 Demonstrative Applications . 121 5.5.1 Case Study 1 { GreenGPS . 121 5.5.2 Case Study 2 { Car Sensor Estimation . 123 vii 5.5.3 Case Study 3 { Obstacle/Hazard Warning . 125 5.6 Evaluation . 126 5.7 User Study . 127 5.8 Related Work . 129 5.8.1 Specialized Data Collection . 130 5.8.2 General Data Collection . 130 5.8.3 Reusable Data-Collection Platforms . 131 5.9 Discussion & Future Work . 132 5.10 Conclusion . 133 5.11 Appendix: Specification Files . 134 VI. Thesis Contributions and Conclusion ............... 135 VII. Interesting Future Direction .................... 137 Bibliography ::::::::::::::::::::::::::::::::::: 139 viii LIST OF FIGURES Figure 2.1 Three different approaches summarized. Each approach was well suited for finding certain kinds of similarities between data. Pairwise correlation found relationships across different kinds of sensor data. CA and PCA modeled normal behavior for same kind of sensor data across vehicles. The highlighted line for CA and PCA are time-series examples which would be marked as anomalous using that approach. Each approach is described in more detail in their respective section below. 14 2.2 CDFs describing the length of road segments and the number of trips across segments. 19 2.3 PCA forward and inverse transformation where X 2 Rn×p;V 2 Rp×k 20 2.4 PCA-based anomaly detection technique applied to the IVBSS dataset. 21 2.5 Clusters found in the IVBSS dataset . 22 2.6 The right two figures show the average change of each pair sensors for one of the drivers in our database. The left two figures show the correlation matrix for one of the trips for that driver. The top row of figures correspond to the entire set of pairs. We selected the pairs which correlate more often and tend to have lower variance in the bottom two figures. The subset shown in the bottom two figures are highlighted in yellow in the top two figures. The bounds in the bottom right figure is the average change of that pair's correlation across trips for this driver. The axes labels have been removed due to lack of space when unnecessary. (Best viewed in color) . 26 2.7 The aggregate correlation of all trips across different drivers and dif- ferent vehicles. The top figure shows the average correlation for all 9 drivers using vehicle 1. The bottom figure shows the average cor- relation for all 16 vehicles. The ID in the X axis corresponds to the pair of sensors in Table 2.3. 27 ix 2.8 The distribution of pairwise correlation within a single trip. One trip was divided into multiple 10-second segments. Each pairwise correlation was calculated for each segment and shown above in the scatter plot and the accompanying CDF. The colors in the scatter plot correspond with the colored lines in the CDF. 28 2.9 Each trip for a driver was divided into 10 second windows. Within each 10 second window, we calculated the correlation and used DB- SCAN to find clusters. For this driver, DBSCAN identified two clusters. 31 2.10 Histogram of how many clusters we found for each of the contexts specified in Table 2.4. For each driver, we collected all 10 second time windows for their trips and ran DBSCAN on the final aggregate plot.