CANet: An Unsupervised Intrusion Detection System for High Dimensional CAN Bus Data

Abstract

We propose a novel neural network architecture for detecting intrusions on the CAN bus. The Controller Area Network (CAN) is the standard communication method between the Electronic Control Units (ECUs) of automobiles. However, CAN lacks security mechanisms and it has recently been shown that it can be attacked remotely. Hence, it is desirable to monitor CAN traffic to detect intrusions. In order to detect both, known and unknown intrusion scenarios, we consider a novel unsupervised learning approach which we call CANet. To our knowledge, this is the first deep learning based intrusion detection system (IDS) that takes individual CAN messages with different IDs and evaluates them in the moment they are received. This is a significant advancement because messages with different IDs are typically sent at different times and with different frequencies. Our method is evaluated on real and synthetic CAN data. For reproducibility of the method, our synthetic data is publicly available. A comparison with previous machine learning based methods shows that CANet outperforms them by a significant margin.

References in corpus (4)

• Adam: A Method for Stochastic Optimization
• Ensemble Adversarial Training: Attacks and Defenses
• Fast and Accurate Deep Network Learning by Exponential Linear Units (ELUs)
• Ensemble Methods as a Defense to Adversarial Perturbations Against Deep Neural Networks

Cited by in corpus (19)

• A Comprehensive Guide to CAN IDS Data & Introduction of the ROAD Dataset
• CANShield: Deep Learning-Based Intrusion Detection Framework for Controller Area Networks at the Signal-Level
• CANflict: Exploiting Peripheral Conflicts for Data-Link Layer Attacks on Automotive Networks
• Benchmarking Frameworks and Comparative Studies of Controller Area Network (CAN) Intrusion Detection Systems: A Review
• Deep Learning-based Embedded Intrusion Detection System for Automotive CAN
• Time-Based CAN Intrusion Detection Benchmark
• Detecting CAN Masquerade Attacks with Signal Clustering Similarity
• Vehicular Intrusion Detection System for Controller Area Network: A Comprehensive Survey and Evaluation
• On the Resilience of Machine Learning-Based IDS for Automotive Networks
• Evaluating the Impact of Privacy-Preserving Federated Learning on CAN Intrusion Detection
• Detecting Masquerade Attacks in Controller Area Networks Using Graph Machine Learning
• Assessing the Resilience of Automotive Intrusion Detection Systems to Adversarial Manipulation
• Detecting message modification attacks on the CAN bus with Temporal Convolutional Networks
• CARACAS: vehiCular ArchitectuRe for detAiled Can Attacks Simulation
• LiPar: A Lightweight Parallel Learning Model for Practical In-Vehicle Network Intrusion Detection
• LATTE: LSTM Self-Attention based Anomaly Detection in Embedded Automotive Platforms
• STATGRAPH: Effective In-vehicle Intrusion Detection via Multi-view Statistical Graph Learning
• DAIRE: A lightweight AI model for real-time detection of Controller Area Network attacks in the Internet of Vehicles
• Evaluating lightweight unsupervised online IDS for masquerade attacks in CAN