A Distributed Anomaly Detection System for In-Vehicle Network Using HTM

Wang, Chundong; Zhao, Zhentang; Gong, Liangyi; Zhu, Likun; Liu, Zheli; Cheng, Xiaochun

doi:10.1109/access.2018.2799210

Cited by 126 publications

(64 citation statements)

References 32 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The central system aggregates the received information from multiple IDS and processes them. Nevertheless, in contrast with the CAN bus environment, hybrid-based anomaly detection in CAN combines more than one method that takes into account the CAN ID field, CAN data payload, CAN specification, CAN timing interval, or its frequency in detecting attacks [53,54].…”

Section: Statistical-based Methodsmentioning

confidence: 99%

“…Weber et al deployed a combination of the specification-based system integrated with a detection mechanism based on machine learning specifically for embedded ECUs in CAN bus traffic [53]. This method is lightweight and also worked in an online manner like [54]. The specification-based part applied static checks at the initial stage, where it conducted payload property inspection statically described in the form of a communication matrix, whereas the machine learning-based part applied learning checks at the second stage for temporal behavior anomaly detection in the CAN time series.…”

Section: Statistical-based Methodsmentioning

confidence: 99%

“…Wang et al developed a hybrid anomaly detection using hierarchical temporal memory (HTM) which is a memory-based system that can train a massive number of CAN time series input while at the same time learning CAN data field sequences [54]. The method worked in an online manner, which relied on the state of prior learning.…”

Section: Statistical-based Methodsmentioning

confidence: 99%

“…To build a profile of normal behavior, the most common techniques that have been employed by the previous researchers are frequencybased, machine learning-based, and statistical-based technique [52]. Meanwhile, a hybrid-based anomaly detection solution is still emerging [53,54]. These techniques however require a lot of computational power [54] which may need to be considered before implementing into low capacity ECUs.…”

Section: Ids Detection Approachmentioning

confidence: 99%

“…Meanwhile, a hybrid-based anomaly detection solution is still emerging [53,54]. These techniques however require a lot of computational power [54] which may need to be considered before implementing into low capacity ECUs. Consequently, the anomaly-based approach should take this issue into account, in particular, for the CAN bus system in the automotive domain.…”

Section: Ids Detection Approachmentioning

confidence: 99%

See 4 more Smart Citations

Intrusion detection system for automotive Controller Area Network (CAN) bus system: a review

Lokman

Othman

Bakar

2019

J Wireless Com Network

160

View full text Add to dashboard Cite

The modern vehicles nowadays are managed by networked controllers. Most of the networks were designed with little concern about security which has recently motivated researchers to demonstrate various kinds of attacks against the system. In this paper, we discussed the vulnerabilities of the Controller Area Network (CAN) within invehicle communication protocol along with some potential attacks that could be exploited against it. Besides, we present some of the security solutions proposed in the current state of research in order to overcome the attacks. However, the main goal of this paper is to highlight a holistic approach known as intrusion detection system (IDS) which has been a significant tool in securing networks and information systems over the past decades. To the best of our knowledge, there is no recorded literature on a comprehensive overview of IDS implementation specifically in the CAN bus network system. Thus, we proposed an in-depth investigation of IDS found in the literature based on the following aspects: detection approaches, deployment strategies, attacking techniques, and finally technical challenges. In addition, we also categorized the anomaly-based IDS according to these methods, e.g., frequencybased, machine learning-based, statistical-based, and hybrid-based as part of our contributions. Correspondingly, this study will help to accelerate other researchers to pursue IDS research in the CAN bus system.

show abstract

Section: Statistical-based Methodsmentioning

confidence: 99%

Section: Statistical-based Methodsmentioning

confidence: 99%

Section: Statistical-based Methodsmentioning

confidence: 99%

Section: Ids Detection Approachmentioning

confidence: 99%

Section: Ids Detection Approachmentioning

confidence: 99%

See 3 more Smart Citations

Intrusion detection system for automotive Controller Area Network (CAN) bus system: a review

Lokman

Othman

Bakar

2019

J Wireless Com Network

160

View full text Add to dashboard Cite

show abstract

Clustering‐based real‐time anomaly detection—A breakthrough in big data technologies

Habeeb

Nasaruddin

Gani

et al. 2019

Trans Emerging Tel Tech

View full text Add to dashboard Cite

Off late, the ever increasing usage of a connected Internet‐of‐Things devices has consequently augmented the volume of real‐time network data with high velocity. At the same time, threats on networks become inevitable; hence, identifying anomalies in real time network data has become crucial. To date, most of the existing anomaly detection approaches focus mainly on machine learning techniques for batch processing. Meanwhile, detection approaches which focus on the real‐time analytics somehow deficient in its detection accuracy while consuming higher memory and longer execution time. As such, this paper proposes a novel framework which focuses on real‐time anomaly detection based on big data technologies. In addition, this paper has also developed streaming sliding window local outlier factor coreset clustering algorithms (SSWLOFCC), which was then implemented into the framework. The proposed framework that comprises BroIDS, Flume, Kafka, Spark streaming, SparkMLlib, Matplot and HBase was evaluated to substantiate its efficacy, particularly in terms of accuracy, memory consumption, and execution time. The evaluation is done by performing critical comparative analysis using existing approaches, such as K‐means, hierarchical density‐based spatial clustering of applications with noise (HDBSCAN), isolation forest, spectral clustering and agglomerative clustering. Moreover, Adjusted Rand Index and memory profiler package were used for the evaluation of the proposed framework against the existing approaches. The outcome of the evaluation has substantially proven the efficacy of the proposed framework with a much higher accuracy rate of 96.51% when compared to other algorithms. Besides, the proposed framework also outperformed the existing algorithms in terms of lesser memory consumption and execution time. Ultimately the proposed solution enable analysts to precisely track and detect anomalies in real time.

show abstract