  This paper presents a new masquerade attack called the cloaking attack and
provides formal analyses for clock skew-based Intrusion Detection Systems
(IDSs) that detect masquerade attacks in the Controller Area Network (CAN) in
automobiles. In the cloaking attack, the adversary manipulates the message
inter-transmission times of spoofed messages by adding delays so as to emulate
a desired clock skew and avoid detection. In order to predict and characterize
the impact of the cloaking attack in terms of the attack success probability on
a given CAN bus and IDS, we develop formal models for two clock skew-based
IDSs, i.e., the state-of-the-art (SOTA) IDS and its adaptation to the widely
used Network Time Protocol (NTP), using parameters of the attacker, the
detector, and the hardware platform. To the best of our knowledge, this is the
first paper that provides formal analyses of clock skew-based IDSs in
automotive CAN. We implement the cloaking attack on two hardware testbeds, a
prototype and a real vehicle (the University of Washington (UW) EcoCAR), and
demonstrate its effectiveness against both the SOTA and NTP-based IDSs. We
validate our formal analyses through extensive experiments for different
messages, IDS settings, and vehicles. By comparing each predicted attack
success probability curve against its experimental curve, we find that the
average prediction error is within 3.0% for the SOTA IDS and 5.7% for the
NTP-based IDS.
