Context Aware Anomaly Detection in Automotive CAN Without Decoding
Introduces a sequence-learning approach that analyzes inter-signal correlations in raw CAN bus payloads to detect stealthy contextual automotive attacks.
Summary
Limitations of Traditional Automotive CAN Anomaly Detectors
Traditional CAN bus intrusion detection systems rely on message frequency tracking or require proprietary DBC decoding files to inspect signal contents. However, sophisticated attackers can inject plausible payloads that blend into expected frequencies.
Context-Aware Sequence Learning on Raw Payloads
Ravi Rajput introduces a deep sequence-learning model that analyzes temporal correlations and contextual relationships across raw CAN payloads without requiring proprietary reverse engineering of message structures.
Detecting Contextual Manipulation Attacks
By learning multi-signal correlations (such as vehicle speed relative to wheel tick sensors and steering angle), the model detects stealthy state manipulation attacks that traditional rule-based detectors miss.
Validation on Automotive Datasets and Testbeds
Evaluating the architecture against real-world vehicular CAN traffic and simulated attack benchmarks demonstrated high detection accuracy and low latency suitable for real-time in-vehicle deployment.
Related talks
Auto Hacking Village·1 hr
Deep Learning on CAN BUS
Applying deep learning algorithms and recurrent neural networks to CAN bus telemetry for automated intrusion detection and anomaly monitoring.
Blue Team Village·25 min
Wendy Edwards
Wendy Edwards separates hype from reality in security AI, analyzing where machine learning excels in anomaly detection and where it fundamentally fails.
Car Hacking Village·26 min
collin · oblivion
Reverse engineers a commercial odometer rollback tool, extracting locked STM32 firmware and showing how CAN messages are intercepted and rewritten.