In-vehicle detection of targeted CAN bus attacks

Abstract

Most vehicles use the controller area network bus for communication between their components. Attackers who have already penetrated the in-vehicle network often utilize this bus in order to take control of safety-relevant components of the vehicle. Such targeted attack scenarios are often hard to detect by network intrusion detection systems because the specific payload is usually not contained within their training data sets. In this work, we describe an intrusion detection system that uses decision trees that have been modelled through genetic programming. We evaluate the advantages and disadvantages of this approach compared to artificial neural networks and rule-based approaches. For this, we model and simulate specific targeted attacks as well as several types of intrusions described in the literature. The results show that the genetic programming approach is well suited to identify intrusions with respect to complex relationships between sensor values which we consider important for the classification of specific targeted attacks. However, the system is less efficient for the classification of other types of attacks which are better identified by the alternative methods in our evaluation. Further research could thus consider hybrid approaches. CCS CONCEPTS• Security and privacy → Intrusion detection systems; • Computing methodologies → Machine learning.

Meta-IDS: Meta-Learning Automotive Intrusion Detection Systems with Adaptive and Learnable

“…Moulahi et al [24] presented a comparative detection performance on Random Forest(RT), Decision Tree(DT), Support Vector Machine(SVM), and Multilayer perception(MLP) based methods. Fenzl et al [25] proposed an IDS based on decision trees modeled through genetic programming.…”

“…However, most of them are only designed for a specific network environment as they are trained on a benchmark dataset that was generated under a designed circumstance and lack generalization ability for tasks from various attack scenarios. [21], [22], [24], [25], [26], [29]. Additionally, the huge computational resources and time cost needed by them to train a model [22] No High High High Moulahi et al [24] No Low High High Fenzl et al [25] No Low High High Ma et al [26] No High High High Ale et al [27] No Low High High Xiao et al [28] No High High High Shi et al [29] No Low High Low Desta et al [30] No Low High Low Ashraf et al [31] No Low High Low Yang et al [ on a high-volume dataset cannot be ignored.…”

“…[21], [22], [24], [25], [26], [29]. Additionally, the huge computational resources and time cost needed by them to train a model [22] No High High High Moulahi et al [24] No Low High High Fenzl et al [25] No Low High High Ma et al [26] No High High High Ale et al [27] No Low High High Xiao et al [28] No High High High Shi et al [29] No Low High Low Desta et al [30] No Low High Low Ashraf et al [31] No Low High Low Yang et al [ on a high-volume dataset cannot be ignored. Most importantly, the trained model may not cope with low-volume attacks as it relies on the learning of high-volume normal and attack traffic samples in the task's dataset.…”

A comprehensive guide to CAN IDS data and introduction of the ROAD dataset

“…Some studies make claim that the ROAD dataset is the most comprehensive and realistic open CAN dataset available for evaluating and comparing CAN IDSs for attacks [51,81]. Other research has referenced the quality of the dataset, used it to establish definitions within the CAN IDS research community, or cited the work as an establishment of research standards [21,[83][84][85][86][87][88][89][90].…”

AI-Based Intrusion Detection Systems for In-Vehicle Networks: A Survey

“…These algorithms include two types of fuzzy-roughKNNs the discernibility classifier and a fuzzy unordered rule induction algorithm. Fenzl et al [41] used DTs modeled through genetic programming to detect intrusions in the CAN bus. Features and feature boundaries selection were based on the CAN DBC files.…”