Abstract:Despite the affordability, simplicity, and efficiency of controller area network (CAN) protocols, the security vulnerability remains a major challenge. Currently, a machine learning-based intrusion detection system (IDS) is considered an effective approach for improving security in CAN by identifying malicious attacks. However, earlier studies that relied on supervised learning methods required considerable amounts of labeled data. Data collection from vehicles is time-consuming and expensive. Furthermore, the obtained data exhibited a class imbalance, which presents further challenges in the analysis and model training. Thus, we propose a semi-supervised learning-based IDS that combines variational autoencoder (VAE) and adversarial reinforcement learning for the multi-class classification of both known and unknown attacks. The proposed system capitalizes on the diverse patterns inherent in unlabeled data, transforming this data space into one that is more conducive to classification. Concurrently, adversarial agents in the reinforcement learning algorithm interact competitively, progressively enhancing their ability to intelligently classify and select samples. To reduce the reliance on labeled data and effectively exploit them, we utilize a pseudo-labeling process for pre-training. Experimental results indicate that the proposed model achieves more effective classification while requiring less labeled data compared to other baseline models for known attacks. By inheriting the advantages of VAE, promising results demonstrate that the proposed system detects unknown attacks containing similar or completely different characteristics with high F1 scores exceeding 0.9 and 0.84, respectively. Finally, the proposed system was demonstrated to be a lightweight model for the expeditious detection of malevolent messages introduced into in-vehicle networks to ensure minimal latency.

Event-Triggered Interval-Based Anomaly Detection and Attack Identification Methods for an In-Vehicle Network

Anomaly Detection in Intra-Vehicle Networks

SAID: State-aware Defense Against Injection Attacks on In-vehicle Network

CANival: A multimodal approach to intrusion detection on the vehicle CAN bus

Machine Learning-Based Anomaly Detection for Securing In-Vehicle Networks

Practical IDS on In-vehicle Network Against Diversified Attack Models

TCE-IDS: Time Interval Conditional Entropy- Based Intrusion Detection System for Automotive Controller Area Networks

A Survey of Anomaly Detection in In-Vehicle Networks

Deep Learning-Based Anomaly Detection for Connected Autonomous Vehicles Using Spatiotemporal Information

Classification of Normal and Malicious Traffic Based on an Ensemble of Machine Learning for a Vehicle CAN-Network

Intrusion Detection System for CAN Bus In-Vehicle Network based on Machine Learning Algorithms

Domain Adversarial Neural Network-Based Intrusion Detection System for In-Vehicle Network Variant Attacks

In-vehicle network intrusion detection using deep convolutional neural network

Multiple Observation HMM-Based CAN Bus Intrusion Detection System for In-Vehicle Network

Semi-supervised intrusion detection system for in-vehicle networks based on variational autoencoder and adversarial reinforcement learning

Long Short-Term Memory Neural Networks for False Information Attack Detection in Software-Defined In-Vehicle Network

Intrusion Detection Method for In-Vehicle CAN Bus Based on Message and Time Transfer Matrix

Intrusion Detection in Intelligent Connected Vehicles Based on Weighted Self-Information

Side Channel Analysis: A Novel Intrusion Detection System Based on Vehicle Voltage Signals

Deep Transfer Learning Based Intrusion Detection System for Electric Vehicular Networks