Abstract:Controller area network (CAN) is a widely used communication protocol for in-vehicle networks. With the up-gradation of traditional vehicle ad-hoc networks (VANETs) to the internet of vehicles (IoV), the connectivity is incremental between the vehicular network and the outside world, making cyber-security become a stringent problem. Although existing machine learning-based methods for automotive intrusion detection are powerful, there are still limitations in detection performance and resistance attack types during the unsupervised learning process that lacks massive amounts of labels. Therefore, this paper proposes an in-vehicle intrusion detection system that incorporates a combination of sparse regularization convolutional auto-encoder (SRCAE) and streams clustering to construct a deep evolving stream clustering model, namely DESC-IDS. Specifically, the method encodes continuous messages as 2-D data frames, which are fed into the SRCAE built by the temporal convolutional network (TCN) to obtain a low-dimensional non-linear spatial–temporal mapping of the high-dimensional data. Thereafter, the stream clustering model can describe a contour baseline of normal communication messages by the spatial–temporal features. Based on this baseline, DESC-IDS can detect any abnormal changes in vehicular communication. In particular, this paper exploits the SRCAE to reconstruct message matrices, which are considered as variants of known attacks due to reconstruction deviation. The extensive evaluation results illustrate that the proposed model provides enough performance and real-time competitiveness in anomaly detection, with 96.44% accuracy on the HCRL intrusion dataset and 98.80% accuracy on the ORNL intrusion dataset. For the mixed attack of fabrication and masquerade, the proposed model achieves stable F1-scores of 93.48% and 86.99%, respectively. Moreover, the performance in unknown attacks is righteous with 98.43% accuracy and 97.15% F1-scores.

VehicleCIDS - an Efficient Vehicle Intrusion Detection System Based on Clock Behavior.

ClockIDS: A Real-Time Vehicle Intrusion Detection System Based on Clock Skew

VehicleEIDS: A Novel External Intrusion Detection System Based on Vehicle Voltage Signals

Intrusion Detection Method for In-Vehicle CAN Bus Based on Message and Time Transfer Matrix

ECF-IDS: An Enhanced Cuckoo Filter-Based Intrusion Detection System for In-Vehicle Network

A Delay Based Plug-in-Monitor for Intrusion Detection in Controller Area Network.

Side Channel Analysis: A Novel Intrusion Detection System Based on Vehicle Voltage Signals

IdentifierIDS: A Practical Voltage-Based Intrusion Detection System for Real In-Vehicle Networks

SAID: State-aware Defense Against Injection Attacks on In-vehicle Network

A Hybrid Intrusion Detection System for for In-Vehicle CAN Bus.

TCE-IDS: Time Interval Conditional Entropy- Based Intrusion Detection System for Automotive Controller Area Networks

Practical IDS on In-vehicle Network Against Diversified Attack Models

A Novel Intrusion Detection System for Next Generation In-Vehicle Networks

An Entropy Analysis based Intrusion Detection System for Controller Area Network in Vehicles

DESC-IDS: Towards an Efficient Real-Time Automotive Intrusion Detection System Based on Deep Evolving Stream Clustering.

An Intrusion Detection System Based on the Double-Decision-Tree Method for In-Vehicle Network

MTH-IDS: A Multi-Tiered Hybrid Intrusion Detection System for Internet of Vehicles

CANival: A multimodal approach to intrusion detection on the vehicle CAN bus

X-CANIDS: Signal-Aware Explainable Intrusion Detection System for Controller Area Network-Based In-Vehicle Network

Investigating the Effects of Attack Detection for In-Vehicle Networks Based on Clock Drift of ECUs

CVMIDS: Cloud–Vehicle Collaborative Intrusion Detection System for Internet of Vehicles