# CAN-LOC: Spoofing Detection and Physical Intrusion Localization on an In-Vehicle CAN Bus Based on Deep Features of Voltage Signals

arXiv: https://arxiv.org/abs/2106.07895 · HTML: https://mlsanity.com/paper/2106.07895/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 8 of its 49 references that are in the map.
- First posted on arXiv 15 Jun 2021.

## Builds on (most cited first, 8 of 8)

- [Very Deep Convolutional Networks for Large-Scale Image Recognition](https://mlsanity.com/paper/1409.1556/) (2014)
- [Manipulating Machine Learning: Poisoning Attacks and Countermeasures for Regression Learning](https://mlsanity.com/paper/1804.00308/) (2018)
- [Data Augmentation for Deep Learning-based Radio Modulation Classification](https://mlsanity.com/paper/1912.03026/) (2019)
- [Viden: Attacker Identification on In-Vehicle Networks](https://mlsanity.com/paper/1708.08414/) (2017)
- [Identifying ECUs Using Inimitable Characteristics of Signals in Controller Area Networks](https://mlsanity.com/paper/1607.00497/) (2016)
- [Cloaking the Clock: Emulating Clock Skew in Controller Area Networks](https://mlsanity.com/paper/1710.02692/) (2017)
- [CAN Radar: Sensing Physical Devices in CAN Networks based on Time Domain Reflectometry](https://mlsanity.com/paper/1910.02847/) (2019)
- [On the Robustness of Signal Characteristic-Based Sender Identification](https://mlsanity.com/paper/1911.09881/) (2019)

## Abstract (arXiv)

The Controller Area Network (CAN) is used for communication between in-vehicle devices. The CAN bus has been shown to be vulnerable to remote attacks. To harden vehicles against such attacks, vehicle manufacturers have divided in-vehicle networks into sub-networks, logically isolating critical devices. However, attackers may still have physical access to various sub-networks where they can connect a malicious device. This threat has not been adequately addressed, as methods proposed to determine physical intrusion points have shown weak results, emphasizing the need to develop more advanced techniques. To address this type of threat, we propose a security hardening system for in-vehicle networks. The proposed system includes two mechanisms that process deep features extracted from voltage signals measured on the CAN bus. The first mechanism uses data augmentation and deep learning to detect and locate physical intrusions when the vehicle starts; this mechanism can detect and locate intrusions, even when the connected malicious devices are silent. This mechanism's effectiveness (100% accuracy) is demonstrated in a wide variety of insertion scenarios on a CAN bus prototype. The second mechanism is a continuous device authentication mechanism, which is also based on deep learning; this mechanism's robustness (99.8% accuracy) is demonstrated on a real moving vehicle.