A hybrid deep learning based intrusion detection system using spatial-temporal representation of in-vehicle network traffic

Lo, Wei; Alqahtani, Hamed; Thakur, Kutub; Almadhor, Ahmad; Chander, Subhash; Kumar, Gulshan

doi:10.1016/j.vehcom.2022.100471

Cited by 56 publications

(46 citation statements)

References 18 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…However, the computational efficiency of the proposed approach has not been discussed. Lo et al [100] used a hybrid model of CNN and LSTM networks for in-vehicle attack detection. CNN was used to extract spatial features, whereas LSTM was used to extract temporal features from CAN data frames.…”

Section: Supervisedmentioning

confidence: 99%

AI-Based Intrusion Detection Systems for In-Vehicle Networks: A Survey

Rajapaksha¹,

Kalutarage

Al-Kadri

et al. 2023

ACM Comput. Surv.

View full text Add to dashboard Cite

The Controller Area Network (CAN) is the most widely used in-vehicle communication protocol, which still lacks the implementation of suitable security mechanisms such as message authentication and encryption. This makes the CAN bus vulnerable to numerous cyber attacks. Various Intrusion Detection Systems (IDSs) have been developed to detect these attacks. However, the high generalization capabilities of Artificial Intelligence (AI) make AI-based IDS an excellent countermeasure against automotive cyber attacks. This article surveys AI-based in-vehicle IDS over the period of 2016-2022 (August) with a novel taxonomy. It reviews the detection techniques, attack types, features, and benchmark datasets. Furthermore, the paper discusses the security of AI models, necessary steps to develop AI-based IDSs in the CAN bus, identifies the limitations of existing proposals and gives recommendations for future research directions.

show abstract

Section: Supervisedmentioning

confidence: 99%

AI-Based Intrusion Detection Systems for In-Vehicle Networks: A Survey

Rajapaksha¹,

Kalutarage

Al-Kadri

et al. 2023

ACM Comput. Surv.

View full text Add to dashboard Cite

show abstract

“…In fact, most of the chosen input features are flow-based (sequence of CAN IDs, number of occurrences on the last second of incoming message CAN ID, relative distance between message CAN ID) and the last one is entropy that, although demonstrated to be a valid feature for flow-based detection methods [28], in our preliminary tests has proven effective only against a very limited set of CAN IDs with very predictable traffic. HyDL-IDS [29] is a supervised, combined IDS for CAN that exploits CNN and LSTM models to extract both temporal and spatial features of the packets. Rec-CNN [30] is a supervised approach that uses Convolutional Neural Network (CNN) by transforming the detection problem into an image-classification one.…”

Section: Combined Idssmentioning

confidence: 99%

CANova: A hybrid intrusion detection framework based on automatic signal classification for CAN

Nichelini

Pozzoli

Longari

et al. 2023

Computers & Security

View full text Add to dashboard Cite

“…Anomaly-based IDS: It recognizes typical system behavior and classifies significant departures from it as intrusions. Wei Lo et al proposed a deep learning IDS that is composed of a convolutional neural network (CNN) and long short-term memory (LSTM) to capture the spatial and temporal dependencies in CAN data [20]. Their IDS performs preprocessing on CAN traffic to reduce inconsistency and incomplete data.…”

Section: A In-vehicle Communication Idssmentioning

confidence: 99%

An Intelligent, Two-Stage, In-Vehicle Diagnostic-Based Secured Framework

et al. 2022

View full text Add to dashboard Cite

Recent research interests have been directed to study the security of vehicles due to the advancement of their technologies. Due to the rapid growth and accelerated development of electronic control units (ECUs), they are countered to be exploited by external attacks. As a result, recent research efforts have been focused on investigating alternative countermeasures that might be implemented by introducing different intrusion detection systems (IDSs). The problem with some of IDSs is the location of their deployment because of the ECU limitations and constraints. Other introduced IDSs require severe changes in the in-vehicle network, which is not preferred by vehicle manufacturers. In this research, we introduce a novel design of a framework to check the state of the vehicle and capture possible attacks by detecting any malicious data in the diagnostic parameters of the vehicle. The framework is divided into two phases: the specific-based detection phase and the anomaly-based detection phase. The proposed system employs the extreme gradient boosting (XGBoost) algorithm to detect anomalies in diagnostic data and it is optimized by a non-dominated sorting genetic algorithm II (NSGA-II). The model is verified against two datasets collected from real vehicles. To generate anomalies in datasets, an attack generation algorithm is introduced. The model is trained on a dataset that contains different attack types and verified blindly against various attacks that have not been seen before. The framework's experimental results show that it can detect abnormalities with accuracy 97.00% for the Seat Leon 2018 dataset and 97.49% for the KIA SOUL dataset.

show abstract

A hybrid deep learning based intrusion detection system using spatial-temporal representation of in-vehicle network traffic

Cited by 56 publications

References 18 publications

AI-Based Intrusion Detection Systems for In-Vehicle Networks: A Survey

AI-Based Intrusion Detection Systems for In-Vehicle Networks: A Survey

CANova: A hybrid intrusion detection framework based on automatic signal classification for CAN

An Intelligent, Two-Stage, In-Vehicle Diagnostic-Based Secured Framework

Contact Info

Product

Resources

About