ECU-Secure: Characteristic Functions for In-Vehicle Intrusion Detection

Chevalier, Yannick; Rieke, Roland; Fenzl, Florian; Chechulin, Andrey; Kotenko, Igor

doi:10.1007/978-3-030-32258-8_58

Cited by 5 publications

(4 citation statements)

References 14 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In the U/SPEED intrusion test the algorithm only discovered an anomalous change in data after the intrusion was finished and subsequently flagged every message afterwards falsely as an intrusion. This shows an potential problem with the algorithm already discussed by Chevalier et al [4].…”

Section: Discussionmentioning

confidence: 89%

“…An important goal of this work is the comparison of GP as an approach to in-vehicle IDS to similar methods proposed. For this purpose, we have chosen ANN as an example of standard machinelearning techniques, as well as CF [4] as a rule-based approach utilizing FC on BA payload values. In machine learning, it is especially important to observe model results not only during training, but also during evaluation under real-life scenarios with unknown data.…”

Section: Resultsmentioning

confidence: 99%

“…A different approach by Marchetti et al [19] used a transition matrix for valid ID sequences. Chevalier et al [4] proposed a characteristic functions approach focussed on the validity of payload values. The latter approach is further used in this work for comparison.…”

Section: Related Workmentioning

confidence: 99%

“…The main contributions of this work are (i) an evaluation of the classification abilities for complex intrusions using GP decision trees as in-vehicle CAN bus IDS with the focus on message payload, (ii) an optimization through prior classification of the message payload, utilizing the field classification (FC) approach by Markovitz et al [20], and, (iii) a comparison of the GP approach to other machine learning approaches, in particular sequential ANN, as well as the characteristic functions (CF) approach by Chevalier et al [4]. The configuration of all approaches was determined with respect to a later implementation on low-performance edge devices within a vehicle.…”

mentioning

confidence: 99%

See 3 more Smart Citations

In-vehicle detection of targeted CAN bus attacks

Fenzl

Rieke

Dominik³

2021

Proceedings of the 16th International Conference on Availability, Reliability and Security

Self Cite

View full text Add to dashboard Cite

Most vehicles use the controller area network bus for communication between their components. Attackers who have already penetrated the in-vehicle network often utilize this bus in order to take control of safety-relevant components of the vehicle. Such targeted attack scenarios are often hard to detect by network intrusion detection systems because the specific payload is usually not contained within their training data sets. In this work, we describe an intrusion detection system that uses decision trees that have been modelled through genetic programming. We evaluate the advantages and disadvantages of this approach compared to artificial neural networks and rule-based approaches. For this, we model and simulate specific targeted attacks as well as several types of intrusions described in the literature. The results show that the genetic programming approach is well suited to identify intrusions with respect to complex relationships between sensor values which we consider important for the classification of specific targeted attacks. However, the system is less efficient for the classification of other types of attacks which are better identified by the alternative methods in our evaluation. Further research could thus consider hybrid approaches. CCS CONCEPTS• Security and privacy → Intrusion detection systems; • Computing methodologies → Machine learning.

show abstract

Section: Discussionmentioning

confidence: 89%

Section: Resultsmentioning

confidence: 99%