A GRU-Based Lightweight System for CAN Intrusion Detection in Real Time

Abstract

With the rapid development of vehicular networking and intelligence, more interfaces are adopted by cars to interact with the external world. Accordingly, this also brings enormous security risks, which are potentially catastrophic due to communication loopholes. Since the Controller Area Network (CAN) is critical to the transmission of commands among vehicular components, it has become a prime target for hacker research and attack. Considering that the CAN bus is commonly used and its protocol is always flawed, how to efficiently detect the intrusions against it has become an evitable problem. In this paper, we presented an intrusion detection system that can be rapidly deployed inside the vehicle. Aiming at achieving the goal of real-time detection, we devised a feature extraction algorithm with low complexity and thoroughly exploited its advantages via a GRU-based lightweight neural network. The experiment was physically conducted on in-vehicle embedded devices using publicly available datasets. Experiment results illustrated that our intrusion detection system could be rapidly deployed with high classification and real-time performance. Moreover, we also discussed how an intrusion detection system could work with OTA services to improve the intelligence of vehicular operating systems and prevent potential attacks.

Meta-IDS: Meta-Learning Automotive Intrusion Detection Systems with Adaptive and Learnable

“…Recently, Deep Learning(DL)-based methods have been proposed with outstanding performance. Ma et al [26] proposed a supervised learning model, by combining a Gated Recurrent Unit(GRU)-based network and a low complexity feature extraction algorithm to detect automotive network attacks. Ale et al [27] developed an IDS using Deep Bayesian Learning (DBL) to detect and analyze automobile hacking attacks.…”

“…However, most of them are only designed for a specific network environment as they are trained on a benchmark dataset that was generated under a designed circumstance and lack generalization ability for tasks from various attack scenarios. [21], [22], [24], [25], [26], [29]. Additionally, the huge computational resources and time cost needed by them to train a model [22] No High High High Moulahi et al [24] No Low High High Fenzl et al [25] No Low High High Ma et al [26] No High High High Ale et al [27] No Low High High Xiao et al [28] No High High High Shi et al [29] No Low High Low Desta et al [30] No Low High Low Ashraf et al [31] No Low High Low Yang et al [ on a high-volume dataset cannot be ignored.…”

Exploring Highly Quantised Neural Networks for Intrusion Detection in Automotive CAN

“…Input Features Used GIDS [30] CAN ID DCNN [13] CAN ID Rec-CNN [38] CAN ID G-IDCS [28] CAN ID TAN-IDS [29] CAN ID iForest [35] Data Field MLIDS [36] CAN ID + Data Field NovelADS [32] CAN ID + Data Field TCAN-IDS [31] CAN ID + Data Field MTH-IDS [37] CAN ID + Data Field HyDL-IDS [33] CAN ID + Data Field + DLC GRU [34] CAN ID + Data Field + DLC CQMLP-IDS (proposed) CAN ID + Data Field IDS using deep convolutional neural networks. They achieve over 99% accuracy for DoS, fuzzing & spoofing attacks.…”

“…In [30], the authors propose a GAN-based IDS and achieve an average accuracy of 97.5% for the same attacks. More complex ML architectures like temporal convolution with global attention [31], a combination of convolutional neural networks (CNN) and long short-term memory (LSTM) cells using both supervised and unsupervised approaches [32], [33], gated recurrent units (GRU) networks [34] have been shown to improve detection accuracy. In [35], the authors use an iForest anomaly detection algorithm as an intrusion prevention system (IPS) to detect fuzzing and spoofing (RPM & Gear) attacks and mark the message as an error preventing its propagation to other ECUs; however, this can cause multiple messages to be dropped from the bus in case of false positives or DoS attacks.…”

“…The key challenge of ML-based approaches is their deployment as an in-vehicle ECU. Most approaches rely on high-performance GPUs to meet the inference deadlines [13], [30]- [32], [34], [36], while others rely on dedicating full ECUs for IDS [35], [37]; both approaches incur additional overheads in energy budget and weight, making them less suited for distributing IDS among different network segments. Similarly, almost all methods presented in the literature require multiple uniquely trained models to detect all possible threat vectors, which incur much higher resources and energy than a singular model which can classify multiple threat vectors.…”