  Dozens of Electronic Control Units (ECUs) can be found on modern vehicles for
safety and driving assistance. These ECUs also introduce new security
vulnerabilities as recent attacks have been reported by plugging the in-vehicle
system or through wireless access. In this paper, we focus on the security of
the Controller Area Network (CAN), which is a standard for communication among
ECUs. CAN bus by design does not have sufficient security features to protect
it from insider or outsider attacks. Intrusion detection system (IDS) is one of
the most effective ways to enhance vehicle security on the insecure CAN bus
protocol. We propose a new IDS based on the entropy of the identifier bits in
CAN messages. The key observation is that all the known CAN message injection
attacks need to alter the CAN ID bits and analyzing the entropy of such bits
can be an effective way to detect those attacks. We collected real CAN messages
from a vehicle (2016 Ford Fusion) and performed simulated message injection
attacks. The experimental results showed that our entropy based IDS can
successfully detect all the injection attacks without disrupting the
communication on CAN.
