IEEE Consumer Electronics Magazine - November/December 2019 - 107

the identification of pseudo PID 37 as the wheel
speed command.

Step 3: ID of PIDs Related to Speed/
Acceleration
Although under normal conditions, the states
(Idle, Accel, Maintain, Decel) can be derived
from the wheel speed alone, attacks or faults in
the network would change the input values
(CAN data) and, thus, necessitate additional
data to handle more complex situations. So, we
derive several other data trends in order to provide corroborating evidence that can be used to
verify whether or not the wheel speed or related
individual commands are being attacked by comparing them to each other. Similarly to the challenge of finding the wheel speed command, the
problem here is that with undocumented commands and data fields, we have to extract information without knowing the exact parsing or
protocol. To solve this, we developed a method
that also utilizes data from a suite of related
commands. Once the wheel speed command
was identified, a covariance across all of the
other data words was performed in order to map
a collection of many CAN data words (communicating key functions of the vehicle) to the physical state (idle speed, accelerating, etc.). The
uniqueness was realized by combining features
based on physical models of the system (in this
case a moving passenger vehicle) with tools that
are typically utilized for unsupervised machine
learning in order to derive the constants for the
equation describing the status of the vehicles
systems.
Specifically, this algorithm involved two
insights: 1) many vehicle sensors report speed
and acceleration-related values via the CAN bus
traffic, and 2) over a given time window, the
velocity and the acceleration will be linearly
independent. Therefore, the covariance of the
data words versus speed and versus acceleration are plotted. Only the highest 25 values were
plotted in order to identify key groupings of
functions. The example shown in Figure 3 demonstrates how the data readings from all of the
PIDs fall into clusters that can be grouped on
the 2-D plot that has speed on the X-axis and
acceleration (first time derivative of speed) on
the Y-axis.

November/December 2019

Figure 3. Plot of the data words with the highest
covariance values with the wheel speed (x-axis)
versus covariance with acceleration (y-axis).
Empirical analysis showed k-means with k ¼ 7
clusters as optimal.

The methods used to determine the optimum
groupings of PID-based datasets included
k-means clustering and tree diagrams. The
k-means clustering with k ¼ 7 results are shown
in Figure 3. Visual inspection shows that there
are approximately seven clusters, five or six of
which should be useful for mapping to physical
systems related in a weighted fashion to speed
and acceleration.

Step 4: Derivation of State Hyperparameters
The next challenge was to optimize the
hyperparameters of the states. As mentioned
previously, we did not assume that either the
number of states or their exact boundaries were
predetermined. So, we assumed four states (for
this phase of the research) but explored methods for automatically determining optimal
parameters to define where states stopped and
started. In this case, the time duration and amplitude range of the state were intuitively chosen as
the hyperparameters of interest that would be
selected once and then used for all future mappings of states. For this research, the hidden
states will represent the state of the accelerator
pedal (increased pressure, neutral pressure, or
slackened pressure), and the observed emissions will be the actual acceleration, maintained
speed, or deceleration of the vehicle.
Step 4 used the trend of this data word over a
scripted set of driving data to optimize the time

107

IEEE Consumer Electronics Magazine - November/December 2019

Table of Contents for the Digital Edition of IEEE Consumer Electronics Magazine - November/December 2019