An Assessment Method for Automotive Intrusion Detection System Performance

Abstract

In response to the increased attack surfaces on modern vehicles due to expanded use of software and the introduction of wireless interfaces, a new market has emerged for intrusion detection systems (IDSs), which can detect some types of attacks and are under development by several companies. NHTSA requested development and demonstration of a method for assessing the in-vehicle performance of anomaly-based IDSs for vehicle data buses, specifically buses using controller area network protocols. IDSs may (1) protect vehicles from direct malicious manipulation of the data bus traffic, or (2) detect symptoms of unfriendly modification of firmware on one of the dozens of electronic control units (ECUs) on a modern vehicle’s network. The methodology used provides a means to assess the performance of automotive IDS products, to provide quantitative and qualitative analysis of performance, and to offer insights on potential IDS options.