Cyberattack detection in vehicles using characteristic functions, artificial neural networks, and visual analysis

Chevalier, Yannick; Fenzl, Florian; Kolomeets, Maxim; Rieke, Roland; Chechulin, Andrey; Kraus, Christoph

doi:10.15622/ia.20.4.4

Cited by 5 publications

(4 citation statements)

References 4 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In the future, we plan to expand the experiments on attack detection by simulating other various kinds of attacks targeted at self-organizing decentralized WSNs with the help of the used software/hardware test-bench. It is also planned to test this complex approach to attack detection in the field of autonomous vehicles [36]. Vehicle swarms can be carriers of WSNs and could be used to extend the range of ground-based WSNs, and they can also perform the function of measuring environmental parameters.…”

Section: Discussionmentioning

confidence: 99%

The Modeling and Detection of Attacks in Role-Based Self-Organized Decentralized Wireless Sensor Networks

Meleshko,

Desnitsky

2024

Telecom

View full text Add to dashboard Cite

This article discusses the modeling and detection of attacks in self-organizing decentralized wireless sensor networks (WSNs) that can be applied to various critical scenarios in practice. Security issues in this type of network have previously been studied to a rather poor extent. In particular, existing attack detection approaches and algorithms do not rely on the properties of self-organization and decentralization, which an attacker is able to exploit to compromise the network and its services. We propose, first, a model of a self-organizing decentralized wireless sensor network; second, a model of the attacks on such networks; third, algorithms for data collection and attack detection; and, finally, a technique for their application. The WSN model represents a formal specification of this type of network, defining the conditions and limitations of network self-organization and decentralization. The model is characterized by a proposed underlying role-based operation of network nodes and a set of their functional states. The proposed attack model covers the possible types of attacks that are relevant to a given type of WSN and are based on the exploitation of the self-organization and decentralization of the network. The developed algorithm for collecting data for attack detection presents specific types of data and their sources. The developed combined attack detection algorithm is formed of actions that detect relevant attacks on self-organizing decentralized WSNs using machine learning methods. The distinctive element of this algorithm is a set of highly specific features that are obtained by analyzing the data collected in the WSN and used to detect attacks. The proposed technique combines the constructed models and algorithms for the sake of tuning and deploying the attack detection module and the effective detection of attacks in practice. This technique specifies the main steps for the joint use of the models and algorithms and the assignment of data collection and detection parameters. The results of the experiments confirm the correctness of the constructed models, algorithms and technique due to the high values of the attack detection quality indicators. Therefore, the practical application of the proposed apparatus will facilitate improvements in the security of self-organizing decentralized WSNs. Experimental research has confirmed the practical applicability of our proposed solutions. In particular, it has shown that the proposed algorithms and the detection technique can detect both attacks implemented through the exploitation of the network’s properties of decentralization/self-organization and common variations in these attacks (i.e., without exploiting the decentralization property). In general, the experimental results expose a high quality of detection, with an f1-score equal to 0.99.

show abstract

Section: Discussionmentioning

confidence: 99%

The Modeling and Detection of Attacks in Role-Based Self-Organized Decentralized Wireless Sensor Networks

Meleshko,

Desnitsky

2024

Telecom

View full text Add to dashboard Cite

show abstract

“…In the article, we considered visualization models as an alternative to graphs as a component of human–machine interaction, inspired by the visualization approaches used in bioinformatics. Despite their low prevalence, it has been shown that they can be an alternative to the established methods of presenting data in various application areas, such as transport systems [ 34 , 98 ], water supply management systems [ 99 ], critical infrastructures [ 100 ], mobile payment systems [ 101 ], social networks [ 102 ], and digital forensics [ 103 ]. The specificity of each model was shown, and the models leveled out the shortcomings in each other.…”

Section: Discussionmentioning

confidence: 99%

“…However, in addition to graphs, there are many other alternative visualization models that are successfully applied in various fields. Of course, these models are Concerning some application areas where graph data structures are common, for example, for the analysis of social networks, computer networks, transport flows, etc., the adaptation of alternative models from bioinformatics makes it possible to get partially rid of the problems inherent in graphs and can provide researchers with a potential alternative to graph models for analyzing the data in other research areas [34].…”

Section: State Of the Artmentioning

confidence: 99%

Graph Visualization: Alternative Models Inspired by Bioinformatics

Kolomeets

Desnitsky

Kotenko

et al. 2023

Sensors

View full text Add to dashboard Cite

Currently, the methods and means of human–machine interaction and visualization as its integral part are being increasingly developed. In various fields of scientific knowledge and technology, there is a need to find and select the most effective visualization models for various types of data, as well as to develop automation tools for the process of choosing the best visualization model for a specific case. There are many data visualization tools in various application fields, but at the same time, the main difficulty lies in presenting data of an interconnected (node-link) structure, i.e., networks. Typically, a lot of software means use graphs as the most straightforward and versatile models. To facilitate visual analysis, researchers are developing ways to arrange graph elements to make comparing, searching, and navigating data easier. However, in addition to graphs, there are many other visualization models that are less versatile but have the potential to expand the capabilities of the analyst and provide alternative solutions. In this work, we collected a variety of visualization models, which we call alternative models, to demonstrate how different concepts of information representation can be realized. We believe that adapting these models to improve the means of human–machine interaction will help analysts make significant progress in solving the problems researchers face when working with graphs.

show abstract

“…In [73], a study investigates the use of a context aware IDS for detecting cyberattacks on the CAN bus and use the ROAD dataset for training. The potential of embedding an IDS that utilizes characteristic functions is proposed in [79], where researchers evaluate the cybersecurity framework on ROAD. In [77], researchers utilize the ROAD dataset to validate a model called "Deep Evolving Stream Clustering-IDS" or DESC-IDS.…”

Section: Plos Onementioning

confidence: 99%

A comprehensive guide to CAN IDS data and introduction of the ROAD dataset

Verma,

Bridges,

Iannacone

et al. 2024

PLoS ONE

View full text Add to dashboard Cite

Although ubiquitous in modern vehicles, Controller Area Networks (CANs) lack basic security properties and are easily exploitable. A rapidly growing field of CAN security research has emerged that seeks to detect intrusions or anomalies on CANs. Producing vehicular CAN data with a variety of intrusions is a difficult task for most researchers as it requires expensive assets and deep expertise. To illuminate this task, we introduce the first comprehensive guide to the existing open CAN intrusion detection system (IDS) datasets. We categorize attacks on CANs including fabrication (adding frames, e.g., flooding or targeting and ID), suspension (removing an ID’s frames), and masquerade attacks (spoofed frames sent in lieu of suspended ones). We provide a quality analysis of each dataset; an enumeration of each datasets’ attacks, benefits, and drawbacks; categorization as real vs. simulated CAN data and real vs. simulated attacks; whether the data is raw CAN data or signal-translated; number of vehicles/CANs; quantity in terms of time; and finally a suggested use case of each dataset. State-of-the-art public CAN IDS datasets are limited to real fabrication (simple message injection) attacks and simulated attacks often in synthetic data, lacking fidelity. In general, the physical effects of attacks on the vehicle are not verified in the available datasets. Only one dataset provides signal-translated data but is missing a corresponding “raw” binary version. This issue pigeon-holes CAN IDS research into testing on limited and often inappropriate data (usually with attacks that are too easily detectable to truly test the method). The scarcity of appropriate data has stymied comparability and reproducibility of results for researchers. As our primary contribution, we present the Real ORNL Automotive Dynamometer (ROAD) CAN IDS dataset, consisting of over 3.5 hours of one vehicle’s CAN data. ROAD contains ambient data recorded during a diverse set of activities, and attacks of increasing stealth with multiple variants and instances of real (i.e. non-simulated) fuzzing, fabrication, unique advanced attacks, and simulated masquerade attacks. To facilitate a benchmark for CAN IDS methods that require signal-translated inputs, we also provide the signal time series format for many of the CAN captures. Our contributions aim to facilitate appropriate benchmarking and needed comparability in the CAN IDS research field.

show abstract

Cyberattack detection in vehicles using characteristic functions, artificial neural networks, and visual analysis

Cited by 5 publications

References 4 publications

The Modeling and Detection of Attacks in Role-Based Self-Organized Decentralized Wireless Sensor Networks

The Modeling and Detection of Attacks in Role-Based Self-Organized Decentralized Wireless Sensor Networks

Graph Visualization: Alternative Models Inspired by Bioinformatics

A comprehensive guide to CAN IDS data and introduction of the ROAD dataset

Contact Info

Product

Resources

About