Campus Units

Electrical and Computer Engineering

Document Type


Publication Version

Accepted Manuscript

Publication Date


Journal or Book Title

IEEE Transactions on Dependable and Secure Computing




There have been several public demonstrations of attacks on connected vehicles showing the ability of an attacker to take control of a targeted vehicle by injecting messages into their CAN bus. In this paper, using injected speed reading and RPM reading messages in in-motion vehicle, we examine the ability of the Pearson correlation and the unsupervised learning methods k-means clustering and HMM to differentiate 'no-attack' and 'under-attack' states of the given vehicle. We found that the Pearson correlation distinguishes the two states, the k-means clustering method has an acceptable accuracy but high false positive rate and HMM detects attacks with acceptable detection rate but has a high false positive in detecting attacks from speed readings when there is no attack. The accuracy of these unsupervised learning methods are comparable to the ones of the supervised learning methods used by CAN bus IDS suppliers. In addition, the paper shows that studying CAN anomaly detection techniques using off-vehicle test facilities may not properly evaluate the performance of the detection techniques. The results suggest using other features besides the data content of the CAN messages and integrate knowledge about how the ECU collaborate in building effective techniques for the detection of injection of fabricated message attacks.


This is a manuscript of an article published as ben Othmane, Lotfi, Lalitha Dhulipala, Nicholas Multari, and Manimaran Govindarasu. "On the Performance of Detecting Injection of Fabricated Messages into the CAN Bus." IEEE Transactions on Dependable and Secure Computing (2020). DOI: 10.1109/TDSC.2020.2990192. Posted with permission.


© 2020 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works.

Copyright Owner




File Format


Published Version