Detection Method and Mitigation of Server-Spoofing Attacks on SOME/IP at the Service Discovery Phase
Adv. Sci. Technol. Eng. Syst. J. 11(1), 25–32 (2026);
DOI: 10.25046/aj110103
Service-oriented architecture has attracted attention in automotive development. The Automotive Open System Architecture (AUTOSAR) specifies Scalable Service-Oriented Middleware over IP (SOME/IP) as a key middleware for service-oriented communication in-vehicles. However, SOME/IP-based networks are vulnerable to server spoofing during the service discovery phase, enabling attackers to cause man-in-the-middle attacks by impersonating legitimate services. This paper proposes a method for detecting attacks in which an attacker spoofs a server during service discovery using a packet switch in a network employing SOME/IP. In addition, a mitigation method is proposed to discard malicious messages. The proposed method addresses the limitations of conventional encryption-based approaches by reducing both processing and communication loads. It also improves anomaly detection rate and detection timing, which have been identified as shortcomings in intrusion detection systems proposed in previous studies. In this study, we evaluated the method using a dataset consisting of 36 attack patterns that combined attack types, attack initiation timing, and message categories. Real-world evaluations demonstrated that the proposed method detected all server spoofing attempts. Further analysis of processing time and memory resource usage confirmed its feasibility for in-vehicle system.
- AUTOSAR, “Specification of SOME/IP Transformer,” Requirement Specification AUTOSAR FO R22-11, 2022.
- AUTOSAR, “SOME/IP Service Discovery Protocol Specification,” Requirement Specification AUTOSAR FO R22-11, 2022.
- M. Cakir, T. Hackel, S. Reider, P. Meyer, F. Korf, T. C. Schmidt, “A QoS Aware Approach to Service-Oriented Communication in Future Automotive Networks,” 2019 IEEE Vehicular Networking Conference (VNC), 1-8, 2019, doi:10.1109/VNC48660.2019.9062794.
- J. R. Seyler, T. Streichert, M. Glass, N. Navet, J. Teich, “Formal analysis of the startup delay of SOME/IP service discovery,” 2015 Design, Automation & Test in Europe Conference & Exhibition (DATE), 49-54, 2015, doi:10.7873/DATE.2015.0469.
- D. Zelle, T. Lauser, T. Kern, C. Krauss, “Analyzing and Securing SOME/IP Automotive Services with Formal and Practical Methods,” 16th International Conference on Availability, Reliability and Security (ARES ’21), Article 8, 1-20, 2021, doi:10.1145/3465481.3465748.
- M. Iorio, M. Reineri, F. Risso, R. Sisto, F. Valenza, “Securing SOME/IP for In-Vehicle Service Protection,” in IEEE Transactions on Vehicular Technology, 69(11), 13450-13466, 2020, doi:10.1109/TVT.2020.3028880.
- T. Koyama, M. Tanaka, A. Miyajima, S. Ukai, T. Sugashima, M. Egawa, “SOME/IP Intrusion Detection System Using Real-Time and Retroactive Anomaly Detection,” 2022 IEEE 95th Vehicular Technology Conference, 1-7, 2022, doi:10.1109/VTC2022-Spring54318.2022.9860928.
- Bayerische Motoren Werke Aktiengesellschaft, “vsomeip,” GitHub, https://github.com/COVESA/vsomeip, 2023.
- K. Koscher, A. Czeskis, F. Roesner, S. Patel, T. Kohno, S. Checkoway, D. McCoy, B. Kantor, D. Anderson, H. Shacham, and S. Savage, “Experimental Security Analysis of a Modern Automobile,” 2010 IEEE Symposium on Security and Privacy, 447-462, May 2010, doi:10.1109/SP.2010.34.
- C. Valasek, C. Miller, “Advanced CAN Injection Techniques for Vehicle Networks,” Black Hat USA 2016, Aug. 2016.
- Cho, Kyong-Tak, Shin, Kang G., “Error Handling of In-vehicle Networks Makes Them Vulnerable,” 2016 ACM SIGSAC Conference on Computer and Communications Security (CCS2016), 1044-1055, Oct. 2016, doi:10.1145/2976749.2978302.
- K. Iehira, H. Inoue, K. Ishida, “Spoofing attack using bus-off attacks against a specific ECU of the CAN bus,” 2018 15th IEEE Annual Consumer Communications & Networking Conference (CCNC), 1-4, Jan. 2018, doi:10.1109/CCNC.2018.8319180.
- K. Iehira, H. Inoue, K. Ishida, “Feasibility assessment of denial-of-service attacks by analyzing SOME/IP-SD state transition models,” 2024 IEEE 48th Annual Computers, Software, and Applications Conference (COMPSAC), 1732-1738, Jul. 2024, doi:10.1109/COMPSAC61105.2024.00273.
- AUTOSAR, “Specification of Secure Onboard Communication Protocol,” Requirement Specification AUTOSAR FO R22-11, 2022.
- SF.Lokman, A.T. Othman, MH. Abu-Bakar, “Intrusion detection system for automotive Controller Area Network (CAN) bus system: a review,” EURASIP Journal on Wireless Communications and Networking 2019, 1-17, Jul. 2019, doi:10.1186/s13638-019-1484-3.
- R. Kurachi, Y. Matsubara, H. Takada, N. Adachi, Y. Miyashita, S. Horihata, “CaCAN-centralized authentication system in CAN (controller area network),”14th Int. Conf. on Embedded Security in Cars (ESCAR 2014), 1-10, Apr. 2014.
-
STmicro, “Data brief of SR6P7C8, SR6P7C4,” Microcontroller Specification, 2022.
- Arm, “Cortex-R52+,” Arm, https://developer.arm.com/Processors/Cortex-R52%20Plus, Aug. 2025 (Date of Access).