Anomaly Detection of CAN Bus Messages Using a Deep Neural Network for Autonomous Vehicles

Abstract

The in-vehicle controller area network (CAN) bus is one of the essential components for autonomous vehicles, and its safety will be one of the greatest challenges in the field of intelligent vehicles in the future. In this paper, we propose a novel system that uses a deep neural network (DNN) to detect anomalous CAN bus messages. We treat anomaly detection as a cross-domain modelling problem, in which three CAN bus data packets as a group are directly imported into the DNN architecture for parallel training with shared weights. After that, three data packets are represented as three independent feature vectors, which corresponds to three different types of data sequences, namely anchor, positive and negative. The proposed DNN architecture is an embedded triplet loss network that optimizes the distance between the anchor example and the positive example, makes it smaller than the distance between the anchor example and the negative example, and realizes the similarity calculation of samples, which were originally used in face detection. Compared to traditional anomaly detection methods, the proposed method to learn the parameters with shared-weight could improve detection efficiency and detection accuracy. The whole detection system is composed of the front-end and the back-end, which correspond to deep network and triplet loss network, respectively, and are trainable in an end-to-end fashion. Experimental results demonstrate that the proposed technology can make real-time responses to anomalies and attacks to the CAN bus, and significantly improve the detection ratio. To the best of our knowledge, the proposed method is the first used for anomaly detection in the in-vehicle CAN bus.Appl. Sci. 2019, 9, 3174 2 of 12 start-stop, parking, Accessory system, and information entertainment systems that can be connected with smart devices such as mobile phones. These systems will obtain data from the CAN bus network on the vehicle. From the perspective of intelligent development, it is inevitable for automobiles to connect to the Internet, and these electronic devices and intelligent information systems may become a way for hackers to intrude into the automobile network system. Once hackers invade these systems and successfully connect to the car CAN bus network, the driver may lose control of the vehicle [3]. At the Black Hat conference in 2014, researchers released a report on the network security of more than 20 models on the market, assessing the ability of different car manufacturers to withstand malicious attacks on different models [4]. In addition, the (Identity Document) ID in the CAN bus protocol only represents the priority of the message, and there is no original address information in the protocol. The receiving electronic control unit (ECU) cannot confirm whether the received data is the original data or not; that is, the authenticity of the received message cannot be confirmed under the existing mechanism, which easily leads to forgery and tampering of the CAN bus message by injecting false information. Wha...

Intrusion Detection for in-Vehicle Communication Networks: An Unsupervised Kohonen SOM Approach

“…In order to run the network, data were properly pre-processed. CAN ID identifiers and data values were dealt with a semantic approach considering each CAN ID identifier as a category of messages sent by an ECU and data values as the related value information [54]. Since SOM networks can process only numerical data, these categorical data were transformed into a matrix representation using the one-hot encoding technique.…”

A Kohonen SOM Architecture for Intrusion Detection on In-Vehicle Communication Networks

“…DNN is also implemented in [32] treating anomaly detection as a cross-domain modelling problem. The proposed technology provides real-time responses to anomalies and attacks to the CAN bus, and improves the detection ratio.…”

“…,I r } be the set of all CAN ID identifiers in the dataset. CAN ID identifiers and data values were regarded with a semantic approach considering each CAN ID identifier I k as a class of messages sent by an ECU and the data values D Ik as the related value information [32]. Since the Kohonen network works by using numerical data, we used the one-hot encoding technique to turn categorical data into a matrix representation.…”

Data Analysis Techniques in Vehicle Communication Networks: Systematic Mapping of Literature

“…The system achieved an efficiency of 99% in some conditions, higher than classic methods of detection, and tested in a simulated data environment. In Zhou, Li, and Shen [16], neural networks were also applied to solve anomalies in the CAN Bus. In their research, data were gathered in a set of three and compared to an anchor set through three deep neural networks.…”