Abstract:Network Intrusion Detection Systems (NIDSs) are widely regarded as efficient tools for securing in-vehicle networks against diverse cyberattacks. However, since cyberattacks are always evolving, signature-based intrusion detection systems are no longer adopted. An alternative solution can be the deployment of deep learning based intrusion detection system which play an important role in detecting unknown attack patterns in network traffic. Hence, in this paper, we compare the performance of different unsupervised deep and machine learning based anomaly detection algorithms, for real-time detection of anomalies on the Audio Video Transport Protocol (AVTP), an application layer protocol implemented in the recent Automotive Ethernet based in-vehicle network. The numerical results, conducted on the recently published "Automotive Ethernet Intrusion Dataset", show that deep learning models significantly outperfom other state-of-the art traditional anomaly detection models in machine learning under different experimental settings.

What problem does this paper attempt to address?

The problem that this paper attempts to solve is to detect unknown network intrusions on the Audio - Video Transport Protocol (AVTP) in real - time in in - vehicle networks based on automotive Ethernet. Specifically, the paper aims to compare the performance of different unsupervised deep - learning and machine - learning algorithms in detecting AVTP protocol anomalies in real - time to deal with evolving network attacks. ### Problem Background 1. **Security Challenges in In - vehicle Networks** - With the development of vehicle - networking technologies, the attack surface of automobiles has expanded significantly, making in - vehicle networks based on automotive Ethernet increasingly vulnerable to network attacks. - These attacks may affect the protocols (such as AVTP) running on them, thereby interrupting critical media - stream transmissions and bringing serious safety and security issues. 2. **Limitations of Existing Methods** - Signature - based intrusion detection systems (IDS) cannot effectively deal with constantly changing new - type attacks because they need to frequently update the signature database. - Therefore, researchers have turned to anomaly - detection - based IDS, especially using deep - learning models to detect unknown attack patterns. ### Paper Objectives - **Evaluating Different Unsupervised Anomaly Detection Methods**: The paper compares different unsupervised deep - learning and machine - learning algorithms to detect the effect of unknown network attacks on the AVTP protocol based on automotive Ethernet in real - time. - **Evaluating Using Public Datasets**: The experiment uses the recently released "Automotive Ethernet Intrusion Detection" dataset, which contains malicious behaviors such as replay attacks. ### Main Contributions - It compares the real - time detection performance of multiple unsupervised anomaly detection methods on the AVTP protocol. - It uses a public dataset to evaluate the performance of these methods and shows the superiority of deep - learning models under different experimental settings. ### Solutions The paper adopts two main types of deep - learning models for anomaly detection: 1. **Convolutional Autoencoder (CAE)** - By reshaping the AVTP packet sequence into a two - dimensional image, it uses convolutional layers and deconvolutional layers to learn feature representations and reconstruct input data. - It detects anomalies by calculating the reconstruction error, that is, when the reconstruction error exceeds a predefined threshold, the sequence is considered abnormal. 2. **Long - Short - Term Memory Autoencoder (LSTMAE)** - It uses LSTM layers to process time - series data and can capture long - term dependencies. - It also detects anomalies by calculating the reconstruction error. In addition, it is also compared with traditional machine - learning methods (such as One - class SVM, Local Outlier Factor, Isolation Forest). ### Experimental Results - Deep - learning models (especially CAE) are significantly superior to traditional machine - learning methods in detecting anomalies on the AVTP protocol. - CAE shows better performance under different window lengths, especially when dealing with longer sequences, it can more effectively capture correlations. - Although LSTMAE also performs well, it has the problem of vanishing or exploding gradients when dealing with long sequences, resulting in its performance being inferior to that of CAE. ### Conclusion The paper shows the potential of deep - learning models in detecting unknown attacks in in - vehicle networks in real - time, especially the advantages of the Convolutional Autoencoder (CAE) in dealing with high - dimensional data and complex patterns. This provides new directions and tools for future in - vehicle network security research.

Unsupervised Network Intrusion Detection System for AVTP in Automotive Ethernet Networks

Machine Learning-Based Anomaly Detection for Securing In-Vehicle Networks

Convolutional neural network-based intrusion detection system for AVTP streams in automotive Ethernet-based networks

Cyber Attack Detection for Self-Driving Vehicle Networks Using Deep Autoencoder Algorithms

Intrusion Detection System for Autonomous Vehicles Using Non-Tree Based Machine Learning Algorithms

Deep Transfer Learning Based Intrusion Detection System for Electric Vehicular Networks

Artificial Intelligence-based intrusion detection system for V2V communication in vehicular adhoc networks

Vehicular Network Intrusion Detection Using a Cascaded Deep Learning Approach with Multi-Variant Metaheuristic

A survey of deep learning-based intrusion detection in automotive applications

Tree-based Intelligent Intrusion Detection System in Internet of Vehicles

Deep Learning-Based Anomaly Detection for Connected Autonomous Vehicles Using Spatiotemporal Information

Anomaly Detection in Intra-Vehicle Networks

Semi-supervised intrusion detection system for in-vehicle networks based on variational autoencoder and adversarial reinforcement learning

Deep Learning-based Intrusion Detection System for Internet of Vehicles

A Framework for the Systematic Assessment of Anomaly Detectors in Time-Sensitive Automotive Networks

Intrusion Detection System for CAN Bus In-Vehicle Network based on Machine Learning Algorithms

Attacks to Automatous Vehicles: A Deep Learning Algorithm for Cybersecurity

DeepSecDrive: an Explainable Deep Learning Framework for Real-Time Detection of Cyberattack in In-Vehicle Networks

A Robust Multi-Stage Intrusion Detection System for In-Vehicle Network Security using Hierarchical Federated Learning

In-vehicle network intrusion detection systems: a systematic survey of deep learning-based approaches