  A bus-off attack is a denial-of-service (DoS) attack which exploits error
handling in the controller area network (CAN) to induce an honest node to
disconnect itself from the CAN bus. This paper develops a stochastic
transmission policy as a countermeasure for the controller-transmitter pair
against the bus-off attack. We model this as a non-zero-sum
linear-quadratic-Gaussian game between the controller-transmitter pair and the
attacker. We derive Nash equilibria of the game for two different information
structures of the attacker. We show that the attacker has a dominant attack
strategy under both information structures. Under the dominant attack strategy,
we show that the optimal control policy is linear in the system state. We
further identify a necessary and a sufficient conditions on the transmission
policy to have bounded average cost. The theoretical results are complemented
by a detailed case study of a bus-off attack on a vehicular adaptive cruise
control model.
