• Anomaly Detection
• CAN
• ECU
• Fingerprinting

Nowadays cars are not longer just transport machines. They have become real "Smart Cars" thanks to the continuous technological development and the continuous search for the connection between the various technological realities that surround us. They are getting more computerized and more communication technologies are used to remotely control several features of the car, and connectivity in modern cars has become a necessity. Manufacturers are trying to give the consumer more ways to remotely control several aspects of the car using more than the traditional radio-controlled door unlocking functionality. For example, WiFi (IEEE 802.11) and Cellular communication such as GSM, 3G, 4G are becoming a more standard option. These communication technologies are also used to control some aspects of the vehicle like turning on air conditioning and even starting the engine. GPS for navigation, and Bluetooth for hands free usage of smart phones, have been used in the past decade. Almost all functions in the modern car are controlled by one or more Electronic Control Units (ECU). An ECU is a small size embedded computer system that has real time computing, time constraints, and low power consumption. As more software modules and external interfaces are getting added on vehicles, new attacks and vulnerabilities are emerging. To counter these vulnerabilities, various types of defense mechanisms have been proposed. In this regard, the following thesis work, in collaboration with Marelli, aims at the realization and implementation of an innovative technique for ECU fingerprinting and anomaly detection in a real CAN Network.
The Fingeprinting technique is based on the characterization of individual ECUs, through the use of its own instrinsic characteristics. In particular, the effect of the "time drift" due to the internal clock oscillator, unique for each ECU, has been analyzed. The technique of "Anomaly Detection", uses the effect of variation of transmission times on the CAN for periodic messages or different time instrinsic characteristics, if they are in the presence of an external attacker to the CAN Network. The ECU Fingerprinting and Anomaly Detection technique has been validated on real-world data acquired, both in case of normal operation or under-attack operation, on the CAN network of a real premium car.