Transformer-Based Attention Network for In-Vehicle Intrusion Detection

Abstract

Despite the significant advantages of communication systems between electronic control units, the controller area network (CAN) protocol is vulnerable to attacks owing to its weak security structure. The persistent development of intrusion detection systems (IDS) is geared toward preventing vehicles from being targeted by malicious attacks. Recurrent neural networks (RNNs) have emerged as a prominent approach in this domain, contributing significantly to the evolution of IDS. Nonetheless, RNN-based methods have certain limitations in step-by-step processing. Their feature extraction at any given point in time only relies on the hidden state of previously observed information, possibly resulting in missing features in the context vector. In this paper, we propose a novel multi-class IDS using a transformer-based attention network (TAN) for an in-vehicle CAN bus. Our model builds on the self-attention mechanism, removing RNNs and classifying attacks into multiple categories. Furthermore, the proposed models can detect replay attacks by aggregating sequential CAN IDs. The experimental results indicate that the TAN is more efficient than the baselines for different input data types and datasets. The highlight is that, although sequential CAN IDs are used, our model can identify intrusion messages without requiring message labeling. Finally, by inheriting the advantages of transformers, TAN employs transfer learning to improve the performance of models trained on small data from other car models.

Exploring Highly Quantised Neural Networks for Intrusion Detection in Automotive CAN

“…Input Features Used GIDS [30] CAN ID DCNN [13] CAN ID Rec-CNN [38] CAN ID G-IDCS [28] CAN ID TAN-IDS [29] CAN ID iForest [35] Data Field MLIDS [36] CAN ID + Data Field NovelADS [32] CAN ID + Data Field TCAN-IDS [31] CAN ID + Data Field MTH-IDS [37] CAN ID + Data Field HyDL-IDS [33] CAN ID + Data Field + DLC GRU [34] CAN ID + Data Field + DLC CQMLP-IDS (proposed) CAN ID + Data Field IDS using deep convolutional neural networks. They achieve over 99% accuracy for DoS, fuzzing & spoofing attacks.…”

“…In [28], authors present a graph based intrusion detection protocol and propose improvements over existing graph based IDS techniques. In [29], a transformer network-based IDS is proposed which demonstrates very high classification accuracy at the cost of higher detection latency. In [30], the authors propose a GAN-based IDS and achieve an average accuracy of 97.5% for the same attacks.…”

“…The misclassifications in our test set can be attributed to scenarios where nearly identical attack and benign message patterns are observed in a block at a given time which leads to an overall false positive rate (FPR) of 0.03% (34 messages falsely classified as attacks out of the total 103176 benign messages). We compare the inference performance of our 2-bit CQMLP model integrated within the ECU against the state-of-the-art IDSs and IPSs proposed in the literature: GIDS [30], DCNN [13], MLIDS [36], HyDL-IDS [33] Nov-elADS [32], TCAN-IDS [31], IForest [35], MTH-IDS [37], GRU [34], G-IDCS [28], TAN-IDS [29] and Rec-CNN [38] which are captured in table IV, comparing them in terms of inference precision, recall, F1 score and false negative rate. For the DoS attack the 2-bit CQMLP performs equally among the proposed IDSs in terms of F1 score.…”

“…It should be noted that the latency metric in the case of block-based IDS does not consider the delay in acquiring the number of CAN messages required, and hence could result in potentially larger delays in detection of the onset of an attack. The tightly integrated CQMLP-IDS achieves 0.11 ms per CAN frame, which is a -99.9 --DCNN [13] 100 99.89 99.95 0.13 MLIDS [36] 99.9 100 99.9 -G-IDCS [28] 99.81 98.86 99.33 -TAN-IDS [29] 100 100 100 -HyDL-IDS [33] 100 100 100 0 NovelADS [32] 99.97 99.91 99.94 -TCAN-IDS [31] [13] 99.95 99.65 99.80 0.5 MLIDS [36] 99.9 99.9 99.9 -G-IDCS [28] 99.71 99 99.35 -TAN-IDS [29] 99.99 99.99 99.99 -HyDL-IDS [33] 99.98 99.88 99.93 NovelADS [32] 99.99 100 100 -TCAN-IDS [31] [13] 99.99 0.05 MLIDS [36] 100 100 -G-IDCS [28] 99.85 98.69 99.27 -TAN-IDS [29] 99.99 99.93 99.96 -HyDL-IDS [33] 100 100 100 0 NovelADS [32] 99.9 99.9 99.9 -TCAN-IDS [31] 99.9 99.9 99.9 -iForest [35] 98.9 100 99.…”

A Study Of Civil Engineering Education At Singapore Nanyang Technology University And At The University Of Florida

“…To protect vehicle network security, the authors in [175] proposed a transformer-based intrusion detection system that provides a sophisticated solution for vehicle networks. This system employs self-attention mechanisms to analyze Controller Area Network (CAN) messages, accurately classifying them into various in-vehicle attacks like denial-of-service, spoofing, and replay attacks.…”