Machine Learning Methods for In-Vehicle Intrusion Detection Roland Rieke ITMO, 2018 Overview Security Challenges for Connected Vehicles Security Measuring Anomaly Detection Machine Learning Methods Data Sets Machine Learning Evaluation Roland Rieke Machine Learning Methods for In-Vehicle Intrusion Detection ITMO’18 2 “If I had asked people what they wanted, they would have said faster horses.” Henry Ford Roland Rieke Machine Learning Methods for In-Vehicle Intrusion Detection ITMO’18 3 Challenge 1898 Faster Horses? 1st international urban-planning conference in NYC 1898 Topic: growing crisis posed by urban horses and their output London 1900: 11.000 cabs + X.000 buses (each 12 horses/day) > 50.000 horses London Times 1894: in 50 years streets buried under 9 feet of manure No solution – the conference was abandoned after 3 days (scheduled 10) Unexpected solution – transition from horses to motor vehicles Source: Stephen Davies, “The Great Horse-Manure Crisis of 1894” Roland Rieke Machine Learning Methods for In-Vehicle Intrusion Detection ITMO’18 4 Challenge 2018 Flying Cars? Transition from relatively isolated autonomous driver-vehicle systems to massively (inter)connected driverless vehicles & global ecosystem. Challenges for Connected Vehicles more efficient (reduce pollution) aware of the situation (but keep privacy) 2018 Problem: Air secure (despite of increased attack surface) Pollution robust against new threats (faking AI or sensors) autonomous (e.g. handle ecosystem failures) Roland Rieke Machine Learning Methods for In-Vehicle Intrusion Detection ITMO’18 5 Connected Cars Vehicular Ad Hoc Network (VANET) / Inter-Vehicle Communication (IVC) VANET: Mobile ad-hoc network whose nodes are vehicles. Modes: Car-2-Car and Car-to-Infrastructure,e.g. Road Side Units Characteristics: self-organising, decentral Applications: Platooning, electronic brake lights, traffic info systems, safety warning Technology: WAVE (Wireless Access in Vehicular Environments);VVLN (Vehicular Visible Light Network) Internet of Vehicles (IoV) IoV: Highly integrated IoT manifestation with respect to vehicular Ecosystem Extend VANET to: Humans (V2H), Sensors (V2S), Clouds (V2C), Internet (V2I) Technology: Mobile Internet connection (GPRS, . ), GPS Roland Rieke Machine Learning Methods for In-Vehicle Intrusion Detection ITMO’18 6 “Once you add a Web browser to a car, it’s over, ” Charlie Miller, Black Hat USA 2014 Roland Rieke Machine Learning Methods for In-Vehicle Intrusion Detection ITMO’18 7 Connectivity Enables Attacks Attacks on safety Attacks on privacy Unauthorized brake Trace vehicle movement Attack emergency call Compromise driver privacy Inflate airbags Manipulate traffic flow Economic Advantage Simulate traffic jam Steal car Force green lights ahead Change driver’s toll bill Manipulate speed limits Manipulate e-charging Roland Rieke Machine Learning Methods for In-Vehicle Intrusion Detection ITMO’18 8 Example: Security Dependencies in Systems of Systems VEHICLE 1 VEHICLE w sense1(✙) send1( ,pos) sensew (data) sendw ( ,pos) gps1(pos) braking1 gpsw (pos) brakingw rec1(data,pos) fwd1(data,pos) recw ( ,pos) fwdw (data,pos) VEHICLE 2 VEHICLE 3 sense2(data) send2(data,pos) sense3(data) send3( ,pos) gps2(pos) braking2 gps3(pos) braking3 rec2( ,pos) fwd2( ,pos) rec3( ,pos) fwd3( ,pos) Authenticityi = Authenticityi−1 ∪ {auth(gpsi (pos),brakingw ,Driverw )} Roland Rieke Machine Learning Methods for In-Vehicle Intrusion Detection ITMO’18 9 Security Risks - Connected Vehicles ECU weaknesses Long-range & IVC network weaknesses concept: post-quantum Firmware over the air (FOTA) production: back-doors Security protections in TCUs deployment: clone Remote diagnostic (and SIEM) generic: crypto library (rand) eCall crash report, emergency warn process: key management T-BOX (crash-resistant telematics) specific: appl. vulnerabilities Remote engine start Sensor & AI (ADAS) weaknesses Sensors vulnerable physical attacks ML is vulnerable to image tampering ML privacy & transparency Adversarial ML In-vehicle network weaknesses Intra-vehicle interface weaknesses No CAN device authentication Protocol vulnerabilities Limited bandwidth on CAN bus Illegal devices access prevents encryption Diagnostic and maintenance Easy external access (OBD) Aftermarket dongles Diagnostic subnetwork Infotainment, mobile phones Roland Rieke Machine Learning Methods for In-Vehicle Intrusion Detection ITMO’18 10 Automotive Threat Intelligence Framework Decide (core) Orient (edge->core) Detect: long/complex phenomena Detect: distributed phenomena Correlate: big data analytics Correlate: agregation, priorisation Diagnosis: risk assessment, threat treatment Observe (edge) Act (core->edge) Detect: simple phenomena, Diagnosis: counter-measures analysis, alerting assessment, policy updates Act: access control, identity & Act: counter-measures deployment authentication, filtering Roland Rieke Machine Learning Methods for In-Vehicle Intrusion Detection ITMO’18 11 Conformance Tracking: Expected vs. observed behavior Cyber-physical observables Event pro- Sensors cessing Observe Conformance tracking Model discovery System behavior: possible sequences of actions. Cyber- physical System systems model Outlier: An obser- Anomaly vation that differs Example: detection so much from other Sensor1: It is dark. observations as to Manipulate Sensor2: The vehicle drives fast. arouse suspicion that Event: Switch light off. it was generated by a Decision different mechanism. Actuators support (Hawkins, 1980) Control Roland Rieke Machine Learning Methods for In-Vehicle Intrusion Detection ITMO’18 12 Anomaly Detection (Behavior-based) Behavior requirements: cyclic messages, protocol flow, process behavior, subsequent payload dependencies. The behavior of a dis- crete system can be formally described by the set of its possible sequences of actions. Roland Rieke Machine Learning Methods for In-Vehicle Intrusion Detection ITMO’18 13 On-board Security Analysis (Observe at the Edge) You can’t defend. You can’t prevent. The only thing you can do is detect and respond. — Bruce Schneier (1) detect & alert specification violation (2) detect & report abnormal activities Roland Rieke Machine Learning Methods for In-Vehicle Intrusion Detection ITMO’18 14 CAN intrusion detection methods Detect specification violations Detect ECU impersonation Formality, Location, Range ECU voltage fingerprinting Sequence (Frequency, Correlation, ECU clock skew fingerprinting Protocol) ECUs check messages with own ID Semantic (Plausibility, Consistency) (parrot defense) remote frame (response time) Detect packet insertions Detect behavior anomalies entropy + state deep learning (e.g. LSTM) time interval OCSVM OCSVM (DoS insert / delete packets) hidden Markov LSTM entropy process mining Roland Rieke Machine Learning Methods for In-Vehicle Intrusion Detection ITMO’18 15 Behavior-based Models Construction of Models ◮ from specifications ◮ from logged behavior without attacks (process mining, OCSVM) ◮ from logged behavior with marked attacks (SVM, neural networks) Monitoring ◮ At operation time, the event stream is compared to the expected behavior (represented by model). ◮ Anomalies indicate possible attacks ◮ Unknown types of attacks can be detected Problems: ◮ Overfitting/Underfitting ◮ False positives ◮ state space explosion (model construction) ◮ insufficient throughput (classification of event stream) Roland Rieke Machine Learning Methods for In-Vehicle Intrusion Detection ITMO’18 16 Process Mining & Synchronization Training set: e1 , e2 , e3 , e4 , e1 , e5 , e6 , e4 Resulting model (Petri net generated by process mining with alpha algorithm): s5 e5 e6 s2 e1 ignore e4 jump s0 s1 s4 s6 e2 e3 s reset 3 Conformance checking: e1, e2 , e6 ignore e6 and continue from s3 reset after e6 and continue from s0 jump to some place reachable by transition e6, e.g. s4 Roland Rieke Machine Learning Methods for In-Vehicle Intrusion Detection ITMO’18 17 (One-Class) Support Vector Machine Classic ◮ Linear classifier ◮ “Max-margin” ◮ Resource efficient One-Class ◮ Novelty/Outlier Detection ◮ Boundary of seen data Computed by: http: //scikit-learn.org/stable/auto_examples/svm/plot_oneclass.html Roland Rieke Machine Learning Methods for In-Vehicle Intrusion Detection ITMO’18 18 Neural Network Input Hidden Hidden Output Layers of Neurons layer layer layer layer Non-linear classifier Itime H1 H1 Many parameters IID O1 Very flexible . Ilen ... Hk Hl IP1 Om . IP8 Roland Rieke Machine Learning Methods for In-Vehicle Intrusion Detection ITMO’18 19 Long Short Term Memory (LSTM) Neural Network Very complex Computationally intensive Models temporal relationships Roland Rieke Machine Learning Methods for In-Vehicle Intrusion Detection ITMO’18 20 Methodology 1 Data Preprocessing 2 Creating Train/Test Split 3 Fit Model using Training-Set 4 Validate Model using Test-Set 5 Visualization 6 Real-time classification of data-stream Roland Rieke Machine Learning Methods for In-Vehicle Intrusion Detection ITMO’18 21 Data Sets ZOE Data Set HCRL Data Sets Collected from Renault Zoe electric car Made available by Hacking and about 10 Minutes; 1.000.000 messages Countermeasure Research Lab 4 Data sets, 3.5 to 4.5 Million Messages DoS, Spoofing/Impersonation (Fuzzy, Gear), and RPM Attacks HCRL: http://ocslab.hksecurity.net/Datasets/CAN-intrusion-dataset Roland Rieke Machine Learning Methods for In-Vehicle Intrusion Detection ITMO’18 22 Attacks in Data Sets ZOE time ID len p1 p2 p3 p4 p5 p6 p7 p8 type 0.0 530 6 254 61 192 108 0 0 117 118 1 0.000206 394 6 255 240 0 6 64 0 117 118 1 HCRL DoS 0.852103 0 8 0