The new generation of car combines incredible software complexity with a full Internet connectivity. As a result cybersecurity and IDS become a “must have feature” of modern software defined vehicle. Nevertheless even if within the new generation of connected cars hardware resources have significantly improved; embedded software capabilities remain very different from what is possible in a data centre or cloud context. When traditional IDS tends to duplicate network traffic to run detection algorithms based on well-known attack signatures; this embedded IDS architecture proposes a very different architecture that leverage Linux kernel probes to detect unexpected behaviours. All this with a minimal impact on the running system and without duplication of network traffic.

• paper [here]
• slides [here]
• video [here]
• conference website [here]