The Controller Area Network (CAN) protocol is the most widely used standard for in-vehicle networks. However, the CAN protocol lacks essential security features (e.g., encryption) which makes it vulnerable to exploits by an adversary. In this paper, we develop CANLP, a Natural Language Processing (NLP)-based intrusion detection system to find whether a transmitted message originated from a legitimate ECU or an adversary. CANLP uses the Term Frequency-Inverse Document Frequency (TF-IDF) to discern complex features associated with CAN data and trains ML models with these features to identify fuzzing, spoofing, and masquerade attacks. When an attack is detected, CANLP identifies the specific ECU on which the attack was mounted on. Through extensive experiments on four public vehicle network datasets, we show that CANLP performs attack classification with high F1-score of 0.9974. We also demonstrate using a testbed that CANLP can be deployed for attack detection on resource-constrained hardware a latency of < 0.05 ms.

Fifth-generation (5G) cellular communication networks are being deployed on applications beyond mobile devices, including vehicular networks and industry automation. Despite their increasing popularity, 5G networks, as defined by the Third Generation Partnership Project (3GPP), have been shown to be vulnerable against fake base station (FBS) attacks. An adversary carrying out an FBS attack emulates a legitimate base station by setting up a rogue base station. This enables the adversary to control the connection of any user equipment that (inadvertently) connects with the rogue base station. Such an adversary can gather sensitive information belonging to the user. While there is a large body of work focused on the development of tools to detect FBSs, the user equipment will continue to remain vulnerable to an FBS attack. In this paper, we propose BARON, a defense methodology to enable user equipment to determine whether a target base station that it is connecting to is legitimate or rogue. BARON accomplishes this by ensuring that the user receives an authentication token from the target base station which can be computed only by a legitimate and trusted entity. As a consequence, receiving such an authentication token from a base station ensures legitimacy of the base station. We evaluate BARON through extensive experiments on the handover process between base stations in 5G networks. Our experimental results show that BARON introduces an overhead of less than 1% during handover completion, which is 10000× lower than the overhead reported by a state-of-the-art method. BARON is also effective in thwarting an FBS attack and quickly recovering connection to a legitimate base station.