# Detecting CAN Masquerade Attacks with Signal Clustering Similarity

arXiv: https://arxiv.org/abs/2201.02665 · HTML: https://mlsanity.com/paper/2201.02665/

## Key facts

- Cited by 5 papers in the map (data through 14 Oct 2026).
- Builds on 6 of its 35 references that are in the map.
- First posted on arXiv 7 Jan 2022.

## Builds on (most cited first, 6 of 6)

- [CANet: An Unsupervised Intrusion Detection System for High Dimensional CAN Bus Data](https://mlsanity.com/paper/1906.02492/) (2019)
- [A Benchmark Study on Time Series Clustering](https://mlsanity.com/paper/2004.09546/) (2020)
- [A Comprehensive Guide to CAN IDS Data & Introduction of the ROAD Dataset](https://mlsanity.com/paper/2012.14600/) (2020)
- [Element-centric clustering comparison unifies overlaps and hierarchy](https://mlsanity.com/paper/1706.06136/) (2017)
- [CAN-D: A Modular Four-Step Pipeline for Comprehensively Decoding Controller Area Network Data](https://mlsanity.com/paper/2006.05993/) (2020)
- [Time-Based CAN Intrusion Detection Benchmark](https://mlsanity.com/paper/2101.05781/) (2021)

## Built on by (most cited first, 5 of 5)

- [CANShield: Deep Learning-Based Intrusion Detection Framework for Controller Area Networks at the Signal-Level](https://mlsanity.com/paper/2205.01306/) (2022)
- [Evaluating lightweight unsupervised online IDS for masquerade attacks in CAN](https://mlsanity.com/paper/2406.13778/) (2024)
- [Adaptive Anomaly Detection for Identifying Attacks in Cyber-Physical Systems: A Systematic Literature Review](https://mlsanity.com/paper/2411.14278/) (2024)
- [Detecting Masquerade Attacks in Controller Area Networks Using Graph Machine Learning](https://mlsanity.com/paper/2408.05427/) (2024)
- [Temporal cross-validation impacts multivariate time series subsequence anomaly detection evaluation](https://mlsanity.com/paper/2506.12183/) (2025)

## Abstract (arXiv)

Vehicular Controller Area Networks (CANs) are susceptible to cyber attacks of different levels of sophistication. Fabrication attacks are the easiest to administer -- an adversary simply sends (extra) frames on a CAN -- but also the easiest to detect because they disrupt frame frequency. To overcome time-based detection methods, adversaries must administer masquerade attacks by sending frames in lieu of (and therefore at the expected time of) benign frames but with malicious payloads. Research efforts have proven that CAN attacks, and masquerade attacks in particular, can affect vehicle functionality. Examples include causing unintended acceleration, deactivation of vehicle's brakes, as well as steering the vehicle. We hypothesize that masquerade attacks modify the nuanced correlations of CAN signal time series and how they cluster together. Therefore, changes in cluster assignments should indicate anomalous behavior. We confirm this hypothesis by leveraging our previously developed capability for reverse engineering CAN signals (i.e., CAN-D [Controller Area Network Decoder]) and focus on advancing the state of the art for detecting masquerade attacks by analyzing time series extracted from raw CAN frames. Specifically, we demonstrate that masquerade attacks can be detected by computing time series clustering similarity using hierarchical clustering on the vehicle's CAN signals (time series) and comparing the clustering similarity across CAN captures with and without attacks. We test our approach in a previously collected CAN dataset with masquerade attacks (i.e., the ROAD dataset) and develop a forensic tool as a proof of concept to demonstrate the potential of the proposed approach for detecting CAN masquerade attacks.