A Lightweight FPGA-based IDS-ECU Architecture for Automotive CAN
Shashwat Khandelwal Shreejith Shanker
Recent years have seen an exponential rise in complex software-driven
functionality in vehicles, leading to a rising number of electronic control
units (ECUs), network capabilities, and interfaces. These expanded capabilities
also bring-in new planes of vulnerabilities making intrusion detection and
management a critical capability; however, this can often result in more ECUs
and network elements due to the high computational overheads. In this paper, we
present a consolidated ECU architecture incorporating an Intrusion Detection
System (IDS) for Automotive Controller Area Network (CAN) along with
traditional ECU functionality on an off-the-shelf hybrid FPGA device, with
near-zero overhead for the ECU functionality. We propose two quantised
multi-layer perceptrons (QMLP's) as isolated IDSs for detecting a range of
attack vectors including Denial-of-Service, Fuzzing and Spoofing, which are
accelerated using off-the-shelf deep-learning processing unit (DPU) IP block
from Xilinx, operating fully transparently to the software on the ECU. The
proposed models achieve the state-of-the-art classification accuracy for all
the attacks, while we observed a 15x reduction in power consumption when
compared against the GPU-based implementation of the same models quantised
using Nvidia libraries. We also achieved a 2.3x speed up in per-message
processing latency (at 0.24 ms from the arrival of a CAN message) to meet the
strict end-to-end latency on critical CAN nodes and a 2.6x reduction in power
consumption for inference when compared to the state-of-the-art IDS models on
embedded IDS and loosely coupled IDS accelerators (GPUs) discussed in the
literature.