{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,6]],"date-time":"2026-09-06T17:46:31Z","timestamp":1788716791495,"version":"build-2803163510"},"reference-count":44,"publisher":"Association for Computing Machinery (ACM)","issue":"6","license":[{"start":{"date-parts":[[2019,11,15]],"date-time":"2019-11-15T00:00:00Z","timestamp":1573776000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"crossref","award":["61672217"],"award-info":[{"award-number":["61672217"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"crossref"}]},{"name":"China Computer Federation(CCF) and NSFOCUS Research Foundation","award":["CCF-NSFOCUS2018009"],"award-info":[{"award-number":["CCF-NSFOCUS2018009"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Embed. Comput. Syst."],"published-print":{"date-parts":[[2019,11,30]]},"abstract":"<jats:p>With the rapid growth of connectivity and autonomy for today\u2019s automobiles, their security vulnerabilities are becoming one of the most urgent concerns in the automotive industry. The lack of message authentication in Controller Area Network (CAN), which is the most popular in-vehicle communication protocol, makes it susceptible to cyber attack. It has been demonstrated that the remote attackers can take over the maneuver of vehicles after getting access to CAN, which poses serious safety threats to the public.<\/jats:p>\n          <jats:p>To mitigate this issue, we propose a novel intrusion detection system (IDS), called BTMonitor (Bit-time-based CAN Bus Monitor). It utilizes the small but measurable discrepancy of bit time in CAN frames to fingerprint their sender Electronic Control Units (ECUs). To reduce the requirement for high sampling rate, we calculate the bit time of recessive bits and dominant bits, respectively, and extract their statistical features as fingerprint. The generated fingerprint is then used to detect intrusion and pinpoint the attacker. BTMonitor can detect new types of masquerade attack that the state-of-the-art clock-skew-based IDS is unable to identify. We implement a prototype system for BTMonitor using Xilinx Spartan 6 FPGA for data collection. We evaluate our method on both a CAN bus prototype and a real vehicle. The results show that BTMonitor can correctly identify the sender with an average probability of 99.76% on the real vehicle.<\/jats:p>","DOI":"10.1145\/3362034","type":"journal-article","created":{"date-parts":[[2019,11,15]],"date-time":"2019-11-15T21:16:57Z","timestamp":1573852617000},"page":"1-23","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":48,"title":["BTMonitor"],"prefix":"10.1145","volume":"18","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-7193-8050","authenticated-orcid":false,"given":"Jia","family":"Zhou","sequence":"first","affiliation":[{"name":"Hunan University, Changsha, Hunan, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Prachi","family":"Joshi","sequence":"additional","affiliation":[{"name":"Virginia Tech, Blacksburg, VA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Haibo","family":"Zeng","sequence":"additional","affiliation":[{"name":"Virginia Tech, Blacksburg, VA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Renfa","family":"Li","sequence":"additional","affiliation":[{"name":"Hunan University, Changsha, Hunan, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2019,11,15]]},"reference":[{"key":"e_1_2_1_1_1","volume-title":"Physical Unclonable Functions in Theory and Practice","author":"B\u00f6hm Christoph"},{"key":"e_1_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICNSS.2011.6060013"},{"key":"e_1_2_1_3_1","volume-title":"Proceedings of the USENIX Conference on Security Symposium. 447--462","author":"Checkoway Stephen","year":"2011"},{"key":"e_1_2_1_4_1","volume-title":"Proceedings of the USENIX Conference on Security Symposium.","author":"Cho Kyong-Tak"},{"key":"e_1_2_1_5_1","volume-title":"Proceedings of the ACM Conference on Computer and Communications Security. 1109--1123","author":"Cho Kyong-Tak"},{"key":"e_1_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1109\/TVT.2018.2810232"},{"key":"e_1_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2018.2812149"},{"key":"e_1_2_1_8_1","unstructured":"FlexRay Consortium. 2005. FlexRay Communication system protocol specification version 2.1. (2005).  FlexRay Consortium. 2005. FlexRay Communication system protocol specification version 2.1. (2005)."},{"key":"e_1_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2014.23059"},{"key":"e_1_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1109\/ETFA.2013.6647940"},{"key":"e_1_2_1_11_1","doi-asserted-by":"crossref","volume-title":"Understanding and Using the Controller Area Network Communication Protocol: Theory and Practice","author":"Natale Marco Di","DOI":"10.1007\/978-1-4614-0314-2"},{"key":"e_1_2_1_12_1","volume-title":"A survey on concept drift adaptation. Comput. Surveys 46, 4","author":"Gama Jo\u00e3o","year":"2014"},{"key":"e_1_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2018.2869351"},{"key":"e_1_2_1_14_1","volume-title":"Proceedings of the International CAN Conference.","author":"Hartwich Florian","year":"2012"},{"key":"e_1_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-87698-4_21"},{"key":"e_1_2_1_16_1","volume-title":"IEEE guide for measurement of environmental sensitivities of standard frequency generators","author":"IEEE.","year":"1993"},{"key":"e_1_2_1_17_1","unstructured":"Infineon. [n.d.]. Microcontroller. Infineon. Retrieved from http:\/\/www.infineon.com\/microcontrollers.  Infineon. [n.d.]. Microcontroller. Infineon. Retrieved from http:\/\/www.infineon.com\/microcontrollers."},{"key":"e_1_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243751"},{"key":"e_1_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1007\/3-540-57868-4_57"},{"key":"e_1_2_1_20_1","volume-title":"Proceedings of the IEEE Symposium on Security and Privacy.","author":"Koscher K."},{"key":"e_1_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1016\/S0141-9331(01)00148-X"},{"key":"e_1_2_1_22_1","volume-title":"Libxtract: Feature extraction library documentation.","year":"2012"},{"key":"e_1_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.1109\/CyberSecurity.2012.7"},{"key":"e_1_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1145\/3274666"},{"key":"e_1_2_1_25_1","doi-asserted-by":"publisher","DOI":"10.1109\/SPW.2012.30"},{"key":"e_1_2_1_26_1","first-page":"260","article-title":"Adventures in automotive networks and control units","volume":"21","author":"Miller Charlie","year":"2013","journal-title":"SANS Whitepaper"},{"key":"e_1_2_1_27_1","first-page":"1","article-title":"Remote exploitation of an unaltered passenger vehicle","volume":"2015","author":"Miller Charlie","year":"2015","journal-title":"Black Hat USA"},{"key":"e_1_2_1_29_1","volume-title":"Proceedings of the ACM Conference on Cyber and Information Security Research. 11","author":"Moore Michael R."},{"key":"e_1_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.7873\/DATE.2015.0174"},{"key":"e_1_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1145\/1180405.1180410"},{"key":"e_1_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.1109\/IVS.2011.5940552"},{"key":"e_1_2_1_33_1","unstructured":"NXP Semiconductor. [n.d.]. NXP Automotive MCUs and MPUs. NXP Semiconductor. Retrieved from www.nxp.com\/docs\/en\/product-selector-guide\/BRAUTOPRDCTMAP.pdf.  NXP Semiconductor. [n.d.]. NXP Automotive MCUs and MPUs. NXP Semiconductor. Retrieved from www.nxp.com\/docs\/en\/product-selector-guide\/BRAUTOPRDCTMAP.pdf."},{"key":"e_1_2_1_34_1","doi-asserted-by":"publisher","DOI":"10.1145\/277858.277865"},{"key":"e_1_2_1_35_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICCPS.2018.00012"},{"key":"e_1_2_1_36_1","volume-title":"Proceedings of the IEEE International Symposium of Circuits and Systems. IEEE, 567--570","author":"Selimis Georgios"},{"key":"e_1_2_1_37_1","volume-title":"Proceedings of the 44th ACM\/IEEE Design Automation Conference. IEEE, 9--14","author":"Edward Suh G.","year":"2007"},{"key":"e_1_2_1_38_1","doi-asserted-by":"publisher","DOI":"10.1145\/3105915"},{"key":"e_1_2_1_39_1","volume-title":"Proceedings of the ECRYPT Workshop on Lightweight Cryptography.","author":"Herrewege Anthony Van","year":"2011"},{"key":"e_1_2_1_40_1","volume-title":"A survey of intrusion detection for in-vehicle networks","author":"Wu Wufei","year":"2019"},{"key":"e_1_2_1_41_1","doi-asserted-by":"publisher","DOI":"10.1145\/3284178"},{"key":"e_1_2_1_42_1","doi-asserted-by":"publisher","DOI":"10.1145\/3302509.3313783"},{"key":"e_1_2_1_43_1","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2019.2895957"},{"key":"e_1_2_1_44_1","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2015.2400413"},{"key":"e_1_2_1_45_1","doi-asserted-by":"publisher","DOI":"10.1007\/s11390-014-1458-1"}],"container-title":["ACM Transactions on Embedded Computing Systems"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3362034","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3362034","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T23:44:53Z","timestamp":1750203893000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3362034"}},"subtitle":["Bit-time-based Intrusion Detection and Attacker Identification in Controller Area Network"],"short-title":[],"issued":{"date-parts":[[2019,11,15]]},"references-count":44,"journal-issue":{"issue":"6","published-print":{"date-parts":[[2019,11,30]]}},"alternative-id":["10.1145\/3362034"],"URL":"https:\/\/doi.org\/10.1145\/3362034","relation":{},"ISSN":["1539-9087","1558-3465"],"issn-type":[{"value":"1539-9087","type":"print"},{"value":"1558-3465","type":"electronic"}],"subject":[],"published":{"date-parts":[[2019,11,15]]},"assertion":[{"value":"2019-08-01","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2019-09-01","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2019-11-15","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}