ANOMALY DETECTION SYSTEM - ROOTCON 13/Talks/Making Anomaly... · 2019. 10. 31. · ECU1 ECU3 Time...

21
ANOMALY DETECTION SYSTEM By Arun Mane and Nikhil Bogam

Transcript of ANOMALY DETECTION SYSTEM - ROOTCON 13/Talks/Making Anomaly... · 2019. 10. 31. · ECU1 ECU3 Time...

  • ANOMALY DETECTION SYSTEM

    By Arun Mane and Nikhil Bogam

  • 2

    •./../Arun

    •Founder and director of AmynaSec Labs

    •Security (Hardware,Vehicle, ICS,IoT )

    •Speaker and Trainer – Defcon,Blackhat, Nullcon,HITB,HIP,Defcon….many

    •Reachable on twitter @rootkill3r

    •[email protected]

    mailto:[email protected]

  • 3

    •./../Nikhil Bogam

    •Safety and Security Manager at Lear Corporation

    •Reachable on twitter @nikhilbogam

    •[email protected]

  • ▪ Role of security in CARs

    ▪ Briefing of CAN bus

    ▪ Attack vectors

    ▪ Introduction of Anomaly detection system ( ADS )

    ▪ Why ADS could be the best solution for CAN network attacks ?

    ▪ ADS working principle

    ▪ Basic attack demo for ADS

    4

    Agenda

  • ▪ Now a days car are connected to internet which lead to risk of remote attack

    ▪ Safety risk : e.g. Compromise brake ECU

    ▪ Privacy risk: e.g. driver information

    ▪ Brand image.

    ▪ etc

    5

  • ▪ Controller Area Network

    ▪ Modern vehicles are full of little embedded systems and electronic control units (ECUs) that can communicate using the CAN protocol.

    ▪ Runs on Two wires

    ▪ CANH

    ▪ CANL

    ▪ CAN uses differential signaling

    ▪ It supports OBD-2

    6

  • ▪ DOS

    ▪ Firehose

    ▪ Packet payload modification

    ▪ Packet replay

    ▪ Right after / Before attack

    8

  • ▪ Anomaly-based IDS observes a real-time system’s activities and compare it against a normal behavior that has been recorded into a profile. Whenever the deviation from normal profile behavior reaches a certain threshold, it will raise the alarm

    9

    Expected CAN

    message flow

    Actual CAN message

    flow

    Raise Alarm

  • ▪ Easy to adopt to existing CAN network

    ▪ Low cost

    ▪ Other solutions need many changes in CAN network, which lead to ECU modification

    ▪ Changing ECU system /software is time consuming for automotive sector due to many compliances.

    10

  • 11

    BCM

    Brake

    Sensor

    ECU

    Light Switch

    ECUHeadlamp

    ECU

    Brake lamp

    ECU

    CAN Bus

  • 12

    BCM

    Brake

    Sensor

    ECU

    Light Switch

    ECUHeadlamp

    ECU

    Brake lamp

    ECU

    CAN Bus

    ADS

  • ▪ Frequency

    ▪ Filtering messages

    ▪ Sequence of IDs

    ▪ Machine Learning

    ▪ etc

    13

  • 14

    03 03

    02 0202 02

    05 0505 05 05 0505 05

    ECU2

    ECU1

    ECU3

    Time

    Time

    Time

    1 secs

    500 ms

    250 ms

  • 15

    03 03 03 03

    CAN packet

    Time between

    packet

    ADS checks if the time between two

    packets are as per expected time.

    CAN

    BUS

    Time

  • 16

    CAN

    Bus05 0003 03 05 FF00 05

    Unexpected

    message

    packet

    ADS checks if no unexpected packet

    is received on the bus

  • 1717

    03 0502 02 05 03

    CAN packets

    ADS checks if the sequence is as per

    expected sequence.

    03 05

    Seq 1

    Seq 2

    Seq 3

    Seq 1Seq 2

    CAN

    BUS

    Time

  • Learning

    18

    Get CAN

    messages

    information

    from

    network

    Learn CAN message

    sequence and timings

    between messages

    Identify Seq

    and timings

    between

    messages

    Learning

    Store

    Identified

    Seq and

    timings

    Check if Seq and timings

    are matching with CAN

    network

    Raise alarm

    if mismatch

    LEARNING PHASE

    EXECUTION PHASE

  • 19

    BCM

    Brake

    Sensor

    ECU

    Light Switch

    ECU

    Headlamp

    ECU

    Brake lamp

    ECU

    CAN Bus

    ADS

    Alarm to

    Driver

    Make Bus OFF in case

    of anomaly detection

    Raise

    Alarm in

    case of

    anomaly

    detection

  • 20

  • Thank you

    21


Anomaly Detection of Wind Turbine Time Series using ...

Anomaly Detection of Wind Turbine Time Series using ...

Anomaly Detection in Predictive Maintenance - KNIME · 1 Anomaly Detection in Predictive Maintenance Time Alignment and Visualization for Anomaly Detection Rosaria Silipo Rosaria.Silipo@knime.com

Anomaly Detection in Predictive Maintenance - KNIME · 1 Anomaly Detection in Predictive Maintenance Time Alignment and Visualization for Anomaly Detection Rosaria Silipo [email protected]

3. JJA time-series - S2S Predictions2sprediction.net/workshop/files/poster/sjohnson_s2s_NMM.pdf · 2015. 7. 30. · JJA all India rainfall anomaly time-series JJA Nino 3.4 SST anomaly

3. JJA time-series - S2S Predictions2sprediction.net/workshop/files/poster/sjohnson_s2s_NMM.pdf · 2015. 7. 30. · JJA all India rainfall anomaly time-series JJA Nino 3.4 SST anomaly

Unsupervised Anomaly Detection in Time Series Data using ... · framework for anomaly detection in time series data. The proposed approach is based on a variational autoencoder, a

Unsupervised Anomaly Detection in Time Series Data using ... · framework for anomaly detection in time series data. The proposed approach is based on a variational autoencoder, a

Real time anomaly detection in network tra c time series · Real time anomaly detection in network tra c time series Sergio Mart nez Taglia co 1, Gast on Garc a Gonz alez , Alicia

Real time anomaly detection in network tra c time series · Real time anomaly detection in network tra c time series Sergio Mart nez Taglia co 1, Gast on Garc a Gonz alez , Alicia

Adaptive Real-time Anomaly-based Intrusion Detection using ...nbn:de:hebis:... · Adaptive Real-time Anomaly-based Intrusion Detection using Data Mining and Machine Learning Techniques

Adaptive Real-time Anomaly-based Intrusion Detection using ...nbn:de:hebis:... · Adaptive Real-time Anomaly-based Intrusion Detection using Data Mining and Machine Learning Techniques

RADS: Real-time Anomaly Detection System for Cloud Data ...

RADS: Real-time Anomaly Detection System for Cloud Data ...

Topographically-Based Real-Time Tra c Anomaly Detection in ...

Topographically-Based Real-Time Tra c Anomaly Detection in ...

HawkEye : A Real-time Anomaly Detection System

HawkEye : A Real-time Anomaly Detection System

REAL-TIME SENTIMENT-BASED ANOMALY DETECTION IN …ourspace.uregina.ca/bitstream/handle/10294/6863/Patel_Khantil_Rag… · REAL-TIME SENTIMENT-BASED ANOMALY DETECTION IN TWITTER DATA

REAL-TIME SENTIMENT-BASED ANOMALY DETECTION IN …ourspace.uregina.ca/bitstream/handle/10294/6863/Patel_Khantil_Rag… · REAL-TIME SENTIMENT-BASED ANOMALY DETECTION IN TWITTER DATA

Time-Series Anomaly Detection Service at MicrosoftAnomaly detection processor calculates the anomaly status for incoming time-series points online. In a common sce-nario of monitoring

Time-Series Anomaly Detection Service at MicrosoftAnomaly detection processor calculates the anomaly status for incoming time-series points online. In a common sce-nario of monitoring

Time series anomaly discovery with grammar-based compression

Time series anomaly discovery with grammar-based compression

Time series anomaly discovery with grammar-based compressionopenproceedings.org/2015/conf/edbt/paper-155.pdf · Time series anomaly discovery with grammar-based compression ... fraud

Time series anomaly discovery with grammar-based compressionopenproceedings.org/2015/conf/edbt/paper-155.pdf · Time series anomaly discovery with grammar-based compression ... fraud

Node Re-Ordering as a Means of Anomaly Detection in Time … · 2020-03-14 · as anomaly detection, PageRank, or graph coloring. In this paper, we focus on detecting anomalies in

Node Re-Ordering as a Means of Anomaly Detection in Time … · 2020-03-14 · as anomaly detection, PageRank, or graph coloring. In this paper, we focus on detecting anomalies in

Deep Learning based Anomaly Detection in€¦ · Deep Learning based Anomaly Detection in Multivariate Time-Series Data 1. Background Anomaly detection, also known as outlier detection,

Deep Learning based Anomaly Detection in€¦ · Deep Learning based Anomaly Detection in Multivariate Time-Series Data 1. Background Anomaly detection, also known as outlier detection,

MAD-GAN: Multivariate Anomaly Detection for Time Series ... · MAD-GAN: Multivariate Anomaly Detection for Time Series Data with Generative Adversarial Networks Dan Li 1, Dacheng

MAD-GAN: Multivariate Anomaly Detection for Time Series ... · MAD-GAN: Multivariate Anomaly Detection for Time Series Data with Generative Adversarial Networks Dan Li 1, Dacheng

Real time contextual collective anomaly detection over ...yxjiang.github.io/paper/odd2014-stream-outlier.pdf · Real time contextual collective anomaly detection over multiple data

Real time contextual collective anomaly detection over ...yxjiang.github.io/paper/odd2014-stream-outlier.pdf · Real time contextual collective anomaly detection over multiple data

Anomaly Detection Solutions for Improved Equipment ... · Anomaly Detection Solutions for Improved Equipment Availability 04 03 02 01 Big Data is the enabler for Hitachi’s Anomaly

Anomaly Detection Solutions for Improved Equipment ... · Anomaly Detection Solutions for Improved Equipment Availability 04 03 02 01 Big Data is the enabler for Hitachi’s Anomaly

Cross-dataset Time Series Anomaly Detection for Cloud Systems · •Anomaly detection in time series data: cloud monitor-ing data is large-scale time series data that has tempo-ral

Cross-dataset Time Series Anomaly Detection for Cloud Systems · •Anomaly detection in time series data: cloud monitor-ing data is large-scale time series data that has tempo-ral

Motif and Anomaly Discovery of Time Series Based on ...

Motif and Anomaly Discovery of Time Series Based on ...