CANTXSec

A Deterministic Intrusion Detection and Prevention System for CAN Bus Monitoring ECU Activations

Folders and files:

• NucleoH743ZI2_cantxsec: contains CANTXSec code, partially based on CANT project.
• Testbed: contains code for the other devices employed in the testbed. In particular:
  • NucleoH743ZI2_busoff: contains code to launch a bus off attack from a STM32.
  • rpi: contains a dump of CAN traffic and some information on how to setup CAN bus on RPi.
  • send_random_stuff: Arduino code to send random packets with fixed ID on the bus.
  • sensor_controller: Arduino code to read data from a light sensor and send them on the bus.
  • stealth_DoS: Arduino code to launch a stelath DoS attack..
• Results: contains raw logs related to the attacks presented on the paper.

---

Notes on the testbed development

• When everything's turned off, the bus should have an impedance (resistance) of 60 Ohms. Similar values are okay, but if something is not working properly, it is worth checking. The transceivers we used have a 120 Ohm resistor attached, such as the shield on the Arduino Uno. Therefore, if you're attaching more than two of them to the bus, you should think about removing some resistors.
• The importance of ACKnoledgments: if you have only one controller in the bus --controller, not transceiver-- no one will send back to packets, triggering a retransmission.
• If you want to use more than one STM32 MCU with the same laptop and decide which code goes to which device, you can follow the instructions on the accepted solution HERE.

Useful commands and tools

To monitor serial ports (usually /dev/ttyACMX where X is a number), you can use different tools, like:

• Minicom: minicom -b 115200 -D /dev/ttyACM0 -O timestamp=extended -z -C /path/to/log.log
  • To exit: CTRL + A, X, Enter
  • Log file is appended, not replaced
  • Useful because of timestamps
• Picocom: picocom -b 115200 /dev/ttyACM0
  • To exit: CTRL + A, CTRL + X
  • No log file, no timestamps

Data collection

When running experiments, you need to collect data. The following commands could be useful.

On the Raspberry Pi, you can use candump -l can1 to start dumping on a file. Thereoretically, there is an option (-t) to generate a nicer timestamp, but it probably does not work if you're logging on to a file. Therefore, you can use this website to convert timestamps when needed.

Arduinos are usually send-only, and you don't need to collect data there. However, if needed, you should print something in the serial. However, remember that if you're doing real-time stuff like single-bit injection, printing on the serial will take a lot of time and maybe mess up the attack. In that case, you can, for instance, print every X error or use a button or something connected to an interrupt to decide when to start printing.

Finally, in the Nucleo MCU, you have problems similar to those of Arduino, so you can use similar strategies. Using minicom, you can save data with timestamps, which are useful later in the data processing. This can also be used for Arduino.

On the simulator, to send the traffic slowly for debug purpose you can use: python-canplayer.py -i socketcan -c can1 -b 500000 -g 0.005 10min_someCommands_candump-2023-06-21_151931.log