# Viden: Attacker Identification on In-Vehicle Networks

arXiv: https://arxiv.org/abs/1708.08414 · HTML: https://mlsanity.com/paper/1708.08414/

## Key facts

- Cited by 8 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 28 Aug 2017.

## Built on by (most cited first, 8 of 8)

- [SoK: Pragmatic Assessment of Machine Learning for Network Intrusion Detection](https://mlsanity.com/paper/2305.00550/) (2023)
- [CANShield: Deep Learning-Based Intrusion Detection Framework for Controller Area Networks at the Signal-Level](https://mlsanity.com/paper/2205.01306/) (2022)
- [TENET: Temporal CNN with Attention for Anomaly Detection in Automotive Cyber-Physical Systems](https://mlsanity.com/paper/2109.04565/) (2021)
- [SecureBERT and LLAMA 2 Empowered Control Area Network Intrusion Detection and Classification](https://mlsanity.com/paper/2311.12074/) (2023)
- [A Lightweight Multi-Attack CAN Intrusion Detection System on Hybrid FPGAs](https://mlsanity.com/paper/2401.10689/) (2024)
- [CAN-LOC: Spoofing Detection and Physical Intrusion Localization on an In-Vehicle CAN Bus Based on Deep Features of Voltage Signals](https://mlsanity.com/paper/2106.07895/) (2021)
- [Security and Interpretability in Automotive Systems](https://mlsanity.com/paper/2212.12101/) (2022)
- [A Lightweight FPGA-based IDS-ECU Architecture for Automotive CAN](https://mlsanity.com/paper/2401.12234/) (2024)

## Abstract (arXiv)

Various defense schemes --- which determine the presence of an attack on the in-vehicle network --- have recently been proposed. However, they fail to identify which Electronic Control Unit (ECU) actually mounted the attack. Clearly, pinpointing the attacker ECU is essential for fast/efficient forensic, isolation, security patch, etc. To meet this need, we propose a novel scheme, called Viden (Voltage-based attacker identification), which can identify the attacker ECU by measuring and utilizing voltages on the in-vehicle network. The first phase of Viden, called ACK learning, determines whether or not the measured voltage signals really originate from the genuine message transmitter. Viden then exploits the voltage measurements to construct and update the transmitter ECUs' voltage profiles as their fingerprints. It finally uses the voltage profiles to identify the attacker ECU. Since Viden adapts its profiles to changes inside/outside of the vehicle, it can pinpoint the attacker ECU under various conditions. Moreover, its efficiency and design-compliance with modern in-vehicle network implementations make Viden practical and easily deployable. Our extensive experimental evaluations on both a CAN bus prototype and two real vehicles have shown that Viden can accurately fingerprint ECUs based solely on voltage measurements and thus identify the attacker ECU with a low false identification rate of 0.2%.