Search

Controller area network (CAN) is the most commonly used bus technology for In-vehicle network and uses multicast communication without corresponding security measures. Therefore, the message data field is vulnerable to tampering and other attacks. Recent machine learning-based intrusion detection methods for CAN bus messages only use the information contained in the message data field and do not take into account the contribution made by the neighboring information of CAN bus messages. In addition, previous models considered the data domain information of CAN bus messages as separate features and did not consider the unique weight of each feature, as well as the second-order interaction information between features. Therefore, we propose a novel intrusion detection model, The Hybrid Similar Neighborhood Robust Factorization Machine Model (HSNRFM), for detecting anomalies in CAN bus messages to address the shortcomings and problems of the previous models. To be able to incorporate the contribution of similar neighborhood information and learn the unique weight parameters of each feature in the model decision process, as well as additional second-order interaction information between features, the HSNRFM model solves the above problem using a similarity calculation method and a factorization machine model. Comprehensive experimental results are compared on real vehicle datasets. The HSNRFM model has AUC values of 0.9216 and 0.901 and AUPR values of 0.9194 and 0.9018 on two real datasets, respectively. And the results show that our proposed HSNRFM model has excellent detection efficiency for intrusion detection of CAN bus messages. [ABSTRACT FROM AUTHOR]

The modern automobile is a complex piece of technology that uses the Controller Area Network (CAN) bus system as a central system for managing the communication between the electronic control units (ECUs). Despite its central importance, the CAN bus system does not support authentication and authorization mechanisms, i.e., CAN messages are broadcast without basic security features. As a result, it is easy for attackers to launch attacks at the CAN bus network system. Attackers can compromise the CAN bus system in several ways including Denial of Service (DoS), Fuzzing and Spoofing attacks. It is imperative to devise methodologies to protect modern cars against the aforementioned attacks. In this paper, we propose a Long Short-Term Memory (LSTM)-based Intrusion Detection System (IDS) to detect and mitigate the CAN bus network attacks. We generate our own dataset by first extracting attack-free data from our experimental car and by injecting attacks into the latter and collecting the dataset. We use the dataset for testing and training our model. With our selected hyper-parameter values, our results demonstrate that our classifier is efficient in detecting the CAN bus network attacks, we achieved an overall detection accuracy of 99.995%. We also compare the proposed LSTM method with the Survival Analysis for automobile IDS dataset which is developed by the Hacking and Countermeasure Research Lab, Korea. Our proposed LSTM model achieves a higher detection rate than the Survival Analysis method.