Temporal-based intrusion detection for IoV

Abstract

The Internet of Vehicle (IoV) is an extension of Vehicle-to-Vehicle (V2V) communication that can improve vehicles’ fully autonomous driving capabilities. However, these communications are vulnerable to many attacks. Therefore, it is critical to provide run-time mechanisms to detect malware and stop the attackers before they manage to gain a foothold in the system. Anomaly-based detection techniques are convenient and capable of detecting off-nominal behavior by the component caused by zero-day attacks. One significant critical aspect when using anomaly-based techniques is ensuring the correct definition of the observed component’s normal behavior. In this paper, we propose using the task’s temporal specification as a baseline to define its normal behavior and identify temporal thresholds that give the system the ability to predict malicious tasks. By applying our solution on one use-case, we got temporal thresholds 20–40 % less than the one usually used to alarm the system about security violations. Using our boundaries ensures the early detection of off-nominal temporal behavior and provides the system with a sufficient amount of time to initiate recovery actions.

Isolation Forest Based on Minimal Spanning Tree

“…Solving the problem is a key factor affecting a large number of related issues. There are many applications in such fields as: Monitoring of intelligent control systems for fault diagnosis [1], [2], ensuring cybersecurity [3], detecting attacks on autonomous vehicle control systems [4], or repairing and deleting records in databases [5]. Another field of application worth mentioning is a wide group of medical tasks [6].…”