Intrusion Detection for in-Vehicle Communication Networks: An Unsupervised Kohonen SOM Approach

Abstract

The diffusion of embedded and portable communication devices on modern vehicles entails new security risks since in-vehicle communication protocols are still insecure and vulnerable to attacks. Increasing interest is being given to the implementation of automotive cybersecurity systems. In this work we propose an efficient and high-performing intrusion detection system based on an unsupervised Kohonen Self-Organizing Map (SOM) network, to identify attack messages sent on a Controller Area Network (CAN) bus. The SOM network found a wide range of applications in intrusion detection because of its features of high detection rate, short training time, and high versatility. We propose to extend the SOM network to intrusion detection on in-vehicle CAN buses. Many hybrid approaches were proposed to combine the SOM network with other clustering methods, such as the k-means algorithm, in order to improve the accuracy of the model. We introduced a novel distance-based procedure to integrate the SOM network with the K-means algorithm and compared it with the traditional procedure. The models were tested on a car hacking dataset concerning traffic data messages sent on a CAN bus, characterized by a large volume of traffic with a low number of features and highly imbalanced data distribution. The experimentation showed that the proposed method greatly improved detection accuracy over the traditional approach.

Towards a Lightweight Intrusion Detection Framework for In-Vehicle Networks

“…To generate accurate in-vehicle data, Vita Santa Barletta et al [14] and Huaxin Li et al [1] generated data by accessing the CAN network via OBD-II of the real vehicle. Messages were injected to perform a specific attack on the CAN bus, and data between two sensors were analyzed to estimate the category of the attack.…”

Vehicle Security: A Survey of Security Issues and Vulnerabilities, Malware Attacks and Defenses

“…However, this method has drawbacks, particularly when the in-vehicle environment changes often; these drawbacks might include the constant requirement for calibration and data updates. Other work by Barletta et al [233] proposed an IDS based on a combination of an unsupervised Kohonen Self-Organizing Map (SOM) network and k-means algorithm. The CAN IDs, timestamp, DLC and data field were used as features in order to identify attack messages sent on the CAN bus.…”

A Kohonen SOM Architecture for Intrusion Detection on In-Vehicle Communication Networks

“…CAN messages can be periodic, sporadic, or aperiodic. Periodic messages are sent at regular time intervals, sporadic messages occur with a minimum time interval and aperiodic messages at arbitrary times [19]. Hence, starting from timestamp defined as S i , with i = 1, .…”

“…In our research, we implemented an anomaly-based IDS for the identification of attack messages injected on the CAN bus using both supervised and unsupervised SOM networks [19] combined with a K-means clustering algorithm.…”