A Blockchain-Based Federated Forest for SDN-Enabled In-Vehicle Network Intrusion Detection System

Abstract

In the modern transportation system, In-vehicle communication systems are managed by controllers know as controller area networks (CAN). The CAN facilitates the interaction of 20 to 100 Electronic Control Units (ECU) which coordinate, monitor and control loads of internal vehicle components such as engine system, brake system and telematics system through the exchange of information among them. CAN operates by broadcasting packets to its bus. This means that all nodes and ECUs attached to the bus can receive the packets, without an authentication mechanism for identifying the legitimacy/source of packets. This makes it vulnerable to attacks. An Intrusion Detection System (IDS) can be used to detect attacks on CAN. Machine learning for the IDS, in particular, would be useful for creating models to detect non-linear attack patterns. However, car manufacturers and owners are might not be willing to just share the sensitive information required for training the models. In this paper, we propose a Blockchain-based Federated Forest Software-Defined Networking (SDN)-enabled Intrusion detection system (BFF-IDS) for an In-vehicle network to address the problem of sharing the sensitive CAN data. Due to the limited scalability of blockchain, InterPlanetary File System (IPFS) was used to host the models, while a hash of the model and a pointer to its location was stored and shared via the blockchain. The SDN provides the dynamic routing of packets and model exchanges from IPFS through the blockchain. In the detection model system, a Federated Learning (FL) method creates a radom forest model in a distributed manner by aggregating partially trained models that were trained by individuals with their data kept confidential during the process. Using Fourier transform, we decomposed the CAN IDs cycle from CAN bus traffic in the frequency domain for better generalization in multiclass detection of attacks. Multiple statistical and entropy features were extracted to handle the high complexity and non-linearity in CAN bus traffic. With this proposed system, manufacturers and car owners may be willing to contribute to the training of the models, as their sensitive data is protected due to the use of FL. By storing hashes of the models on a blockchain, the risk of adversaries poisoning the models is reduced and a single point of failure is avoided. The evaluation was conducted by performing experiments in a testbed. We found that the proposed system has efficient use of memory and CPU resources, and that the detection rate of closely related attacks was high.

ID-RDRL: a deep reinforcement learning-based feature selection intrusion detection model

“…In the era of big data, machine learning approaches have been widely implemented in intrusion detection systems (IDS), and part of the research has employed classic machine learning algorithms or their enhancements, such as SVM, K-means, KNN, RF, and so on 1 , 18 – 20 , and deep learning algorithms, such as ANN, CNN, LSTM, etc 21 – 27 . In the literature 28 , the authors suggest an IDS based on spark and Conv-AE that employs public datasets such as KDD99 for performance evaluation, and the findings indicate that imbalanced datasets affect model performance.…”

ID-RDRL: A Deep Reinforcement Learning-based Feature Selection Intrusion Detection Model

“…In the era of big data, machine learning approaches have been widely implemented in intrusion detection systems (IDS), and part of the research has employed classic machine learning algorithms or their enhancements, such as SVM, K-means, KNN, RF, and so on 1,[7][8][9] , and deep learning algorithms, such as ANN, CNN, LSTM, etc [10][11][12][13][14][15][16] . In the literature 17 , the authors suggest an IDS based on spark and Conv-AE that employs public datasets such as KDD99 for performance evaluation, and the findings indicate that imbalanced datasets affect model performance.…”

Statistical Detection of Adversarial Examples in Blockchain-Based Federated Forest In-Vehicle Network Intrusion Detection System

“…The federated model is then finally aggregated at the users' end. The detailed design and implementation of the BFF-IDS are provided in [10]-the CAN ID cycle (frequency of occurrence) is extracted and transformed using Fast Fourier Transform(FFT); statistical and entropy features are then extracted. The features include minimum, maximum, mean, standard deviation, skewness, kurtosis, Shannon entropy, sample entropy and permutation entropy.…”

“…A Blockchain-based Federated Forest Software Defined Networking (SDN)-enabled Intrusion Detection System (BFF-IDS) can be used to support ML that utilizes the data available in the whole ecosystem of vehicles while at the same time protecting sensitive data [10]. In BFF-IDS, each participating vehicle (miner) trains a partial model and stores it at an InterPlanetary File System (IPFS).…”