{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,8,7]],"date-time":"2026-08-07T14:44:57Z","timestamp":1786113897550,"version":"3.56.0"},"reference-count":31,"publisher":"Association for Computing Machinery (ACM)","issue":"2","license":[{"start":{"date-parts":[[2024,4,30]],"date-time":"2024-04-30T00:00:00Z","timestamp":1714435200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Cyber-Phys. Syst."],"published-print":{"date-parts":[[2024,4,30]]},"abstract":"<jats:p>This work presents an experimental evaluation of the detection performance of eight different algorithms for anomaly detection on the Controller Area Network (CAN) bus of modern vehicles based on the analysis of the timing or frequency of CAN messages. This work solves the current limitations of related scientific literature, which is based on a private dataset and lacks open implementations and a detailed description of the detection algorithms. These drawbacks prevent the reproducibility of published results, making it impossible to compare a novel proposal against related work, thus hindering the advancement of science. This article solves these issues by publicly releasing implementations and labeled datasets and by describing unbiased experimental comparisons.<\/jats:p>","DOI":"10.1145\/3604913","type":"journal-article","created":{"date-parts":[[2023,6,15]],"date-time":"2023-06-15T12:09:51Z","timestamp":1686830991000},"page":"1-24","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":10,"title":["Performance Comparison of Timing-Based Anomaly Detectors for Controller Area Network: A Reproducible Study"],"prefix":"10.1145","volume":"8","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-2421-1852","authenticated-orcid":false,"given":"Francesco","family":"Pollicino","sequence":"first","affiliation":[{"name":"University of Modena and Reggio Emilia, Modena, ITA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6850-334X","authenticated-orcid":false,"given":"Dario","family":"Stabili","sequence":"additional","affiliation":[{"name":"University of Bologna, Bologna, Bologna"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7408-6906","authenticated-orcid":false,"given":"Mirco","family":"Marchetti","sequence":"additional","affiliation":[{"name":"University of Modena and Reggio Emilia, Modena, ITA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2024,5,14]]},"reference":[{"key":"e_1_3_2_2_2","doi-asserted-by":"publisher","DOI":"10.1109\/iCCECOME.2018.8658720"},{"issue":"5","key":"e_1_3_2_3_2","doi-asserted-by":"crossref","DOI":"10.1109\/TKDE.2010.235","article-title":"Anomaly detection for discrete sequences: A survey","volume":"24","author":"Chandola V.","year":"2012","unstructured":"V. Chandola, A. Banerjee, and V. Kumar. 2012. Anomaly detection for discrete sequences: A survey. IEEE Trans. on Knowledge and Data Engineering 24, 5 (2012).","journal-title":"IEEE Trans. on Knowledge and Data Engineering"},{"key":"e_1_3_2_4_2","volume-title":"USENIX Security Symposium","author":"Cho K. T.","year":"2016","unstructured":"K. T. Cho and K. G. Shin. 2016. Fingerprinting electronic control units for vehicle intrusion detection. In USENIX Security Symposium."},{"key":"e_1_3_2_5_2","volume-title":"Viden: Attacker Identification on In-Vehicle Networks","author":"Cho K. T.","year":"2017","unstructured":"K. T. Cho and K. G. Shin. 2017. Viden: Attacker Identification on In-Vehicle Networks. arXiv 1109.1123."},{"key":"e_1_3_2_6_2","volume-title":"2019 IEEE International Conference on Vehicular Electronics and Safety","author":"Dupont G.","year":"2019","unstructured":"G. Dupont, J. den Hartog, S. Etalle, and A. Lekidis. 2019. A survey of network intrusion detection systems for controller area network. In 2019 IEEE International Conference on Vehicular Electronics and Safety."},{"key":"e_1_3_2_7_2","volume-title":"CAN Specification Version 2.0","author":"GmbH Robert Bosch","year":"1991","unstructured":"Robert Bosch GmbH. 1991. CAN Specification Version 2.0. Technical Report."},{"key":"e_1_3_2_8_2","doi-asserted-by":"publisher","DOI":"10.1109\/STA.2016.7952095"},{"key":"e_1_3_2_9_2","doi-asserted-by":"publisher","DOI":"10.1109\/TITS.2021.3078740"},{"key":"e_1_3_2_10_2","unstructured":"Ken Tindell. ([n.d.]). Canis Automotive Labs - The CANPico Board. https:\/\/kentindell.github.io\/canpico."},{"key":"e_1_3_2_11_2","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243751"},{"key":"e_1_3_2_12_2","first-page":"389","volume-title":"28th USENIX Security Symposium (USENIX Security 19)","author":"Kulandaivel Sekar","year":"2019","unstructured":"Sekar Kulandaivel, Tushar Goyal, Arnav Kumar Agrawal, and Vyas Sekar. 2019. CANvas: Fast and inexpensive automotive network mapping. In 28th USENIX Security Symposium (USENIX Security 19). USENIX Association, Santa Clara, CA, 389\u2013405. https:\/\/www.usenix.org\/conference\/usenixsecurity19\/presentation\/kulandaivel."},{"key":"e_1_3_2_13_2","doi-asserted-by":"publisher","DOI":"10.1109\/AINA.2015.274"},{"key":"e_1_3_2_14_2","doi-asserted-by":"publisher","DOI":"10.1109\/PST.2017.00017"},{"key":"e_1_3_2_15_2","volume-title":"Conf. Innovative Trends in Computer Science","author":"Ling C.","year":"2012","unstructured":"C. Ling. 2012. An algorithm for detection of malicious messages on CAN buses. In Conf. Innovative Trends in Computer Science."},{"key":"e_1_3_2_16_2","volume-title":"IEEE Proceedings of Intelligent Vehicles Symposium.","author":"Marchetti M.","year":"2017","unstructured":"M. Marchetti and D. Stabili. 2017. Anomaly detection of CAN bus messages through analysis of ID sequences. In IEEE Proceedings of Intelligent Vehicles Symposium."},{"key":"e_1_3_2_17_2","volume-title":"IEEE 2nd International Forum Research and Technologies for Society and Industry Leveraging a better tomorrow","author":"Marchetti M.","year":"2016","unstructured":"M. Marchetti, D. Stabili, A. Guido, and M. Colajanni. 2016. Evaluation of anomaly detection for in-vehicle networks through information-theoretic algorithms. In IEEE 2nd International Forum Research and Technologies for Society and Industry Leveraging a better tomorrow."},{"key":"e_1_3_2_18_2","unstructured":"C. Miller and C. Valasek. 2014. Adventures in Automotive Networks and Control Units. https:\/\/www.ioactive.com\/pdfs\/IOActive_Adventures_in_Automotive_Networks_and_Control_Units.pdf."},{"key":"e_1_3_2_19_2","unstructured":"C. Miller and C. Valasek. 2015. Remote Exploitation of an Unaltered Passenger Vehicle. http:\/\/illmatics.com\/RemoteCarHacking.pdf."},{"key":"e_1_3_2_20_2","doi-asserted-by":"publisher","DOI":"10.1145\/3064814.3064816"},{"key":"e_1_3_2_21_2","volume-title":"IEEE Proceedings of Intelligent Vehicles Symposium.","author":"M\u00fcter M.","year":"2011","unstructured":"M. M\u00fcter and N. Asaj. 2011. Entropy-based anomaly detection for in-vehicle networks. In IEEE Proceedings of Intelligent Vehicles Symposium."},{"key":"e_1_3_2_22_2","unstructured":"N. Nowdehi W. Aoudi M. Almgren and T. Olovsson. 2019. CASAD: CAN-Aware Stealthy-Attack Detection for In-Vehicle Networks. (2019)."},{"key":"e_1_3_2_23_2","doi-asserted-by":"publisher","DOI":"10.1109\/TVT.2019.2961344"},{"key":"e_1_3_2_24_2","doi-asserted-by":"publisher","DOI":"10.4271\/2014-01-0340"},{"key":"e_1_3_2_25_2","volume-title":"PCAN-USB","author":"System PEAK","year":"2015","unstructured":"PEAK System. 2015. PCAN-USB. Technical Report."},{"key":"e_1_3_2_26_2","unstructured":"F. Pollicino D. Stabili and M. Marchetti. ([n.d.]). Material used for the submission at ACM TCPS - Special Issue. https:\/\/weblab.ing.unimore.it\/people\/stabili\/resources\/tcps.shtml. password: PSM_TCPS."},{"key":"e_1_3_2_27_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICOIN.2016.7427089"},{"key":"e_1_3_2_28_2","volume-title":"DAGA: Detecting Attacks to In-Vehicle Networks Via N-Gram Analysis","author":"Stabili D.","year":"2021","unstructured":"D. Stabili, L. Ferretti, M. Andreolini, and M. Marchetti. 2021. DAGA: Detecting Attacks to In-Vehicle Networks Via N-Gram Analysis. arXiv 0000.0000."},{"key":"e_1_3_2_29_2","volume-title":"2019 IEEE 90th Vehicular Technology Conference.","author":"Stabili D.","year":"2019","unstructured":"D. Stabili and M. Marchetti. 2019. Detection of Missing CAN Messages through Inter-Arrival Time Analysis. In 2019 IEEE 90th Vehicular Technology Conference."},{"key":"e_1_3_2_30_2","volume-title":"AEIT International Annual Conference.","author":"Stabili D.","year":"2017","unstructured":"D. Stabili, M. Marchetti, and M. Colajanni. 2017. Detecting attacks to internal vehicle networks through Hamming distance. In AEIT International Annual Conference."},{"key":"e_1_3_2_31_2","doi-asserted-by":"publisher","DOI":"10.1109\/WCICSS.2015.7420322"},{"key":"e_1_3_2_32_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.compeleceng.2021.107048"}],"container-title":["ACM Transactions on Cyber-Physical Systems"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3604913","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3604913","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T16:46:05Z","timestamp":1750178765000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3604913"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,4,30]]},"references-count":31,"journal-issue":{"issue":"2","published-print":{"date-parts":[[2024,4,30]]}},"alternative-id":["10.1145\/3604913"],"URL":"https:\/\/doi.org\/10.1145\/3604913","relation":{},"ISSN":["2378-962X","2378-9638"],"issn-type":[{"value":"2378-962X","type":"print"},{"value":"2378-9638","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024,4,30]]},"assertion":[{"value":"2021-07-01","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2023-04-09","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2024-05-14","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}