  Various defense schemes --- which determine the presence of an attack on the
in-vehicle network --- have recently been proposed. However, they fail to
identify which Electronic Control Unit (ECU) actually mounted the attack.
Clearly, pinpointing the attacker ECU is essential for fast/efficient forensic,
isolation, security patch, etc. To meet this need, we propose a novel scheme,
called Viden (Voltage-based attacker identification), which can identify the
attacker ECU by measuring and utilizing voltages on the in-vehicle network. The
first phase of Viden, called ACK learning, determines whether or not the
measured voltage signals really originate from the genuine message transmitter.
Viden then exploits the voltage measurements to construct and update the
transmitter ECUs' voltage profiles as their fingerprints. It finally uses the
voltage profiles to identify the attacker ECU. Since Viden adapts its profiles
to changes inside/outside of the vehicle, it can pinpoint the attacker ECU
under various conditions. Moreover, its efficiency and design-compliance with
modern in-vehicle network implementations make Viden practical and easily
deployable. Our extensive experimental evaluations on both a CAN bus prototype
and two real vehicles have shown that Viden can accurately fingerprint ECUs
based solely on voltage measurements and thus identify the attacker ECU with a
low false identification rate of 0.2%.
