WIP: AMICA: Attention-based Multi-Identifier model for asynchronous intrusion detection on Controller Area networks

Alkhatib, Natasha; Achaji, Lina; Mushtaq, Maria; Ghauch, Hadi; Danger, Jean‐Luc

doi:10.14722/vehiclesec.2023.23033

Cited by 2 publications

(1 citation statement)

References 0 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The text describes the utilization of a mature SOME/IP generator [43], which has been widely applied in network attack detection [3,12,44]. This generator simulates the behavior of multiple clients (ECUs) and servers (ECUs), as well as various attacks by attackers.…”

Section: Datasetmentioning

confidence: 99%

HP-LSTM: Hawkes Process–LSTM-Based Detection of DDoS Attack for In-Vehicle Network

Li,

Liu

2024

Future Internet

View full text Add to dashboard Cite

Connected and autonomous vehicles (CAVs) are advancing at a fast speed with the improvement of the automotive industry, which opens up new possibilities for different attacks. A Distributed Denial-of-Service (DDoS) attacker floods the in-vehicle network with fake messages, resulting in the failure of driving assistance systems and impairment of vehicle control functionalities, seriously disrupting the normal operation of the vehicle. In this paper, we propose a novel DDoS attack detection method for in-vehicle Ethernet Scalable service-Oriented Middleware over IP (SOME/IP), which integrates the Hawkes process with Long Short-Term Memory networks (LSTMs) to capture the dynamic behavioral features of the attacker. Specifically, we employ the Hawkes process to capture features of the DDoS attack, with its parameters reflecting the dynamism and self-exciting properties of the attack events. Subsequently, we propose a novel deep learning network structure, an HP-LSTM block, inspired by the Hawkes process, while employing a residual attention block to enhance the model’s detection efficiency and accuracy. Additionally, due to the scarcity of publicly available datasets for SOME/IP, we employed a mature SOME/IP generator to create a dataset for evaluating the validity of the proposed detection model. Finally, extensive experiments were conducted to demonstrate the effectiveness of the proposed DDoS attack detection method.

show abstract

Section: Datasetmentioning

confidence: 99%