A Multiple Rényi Entropy Based Intrusion Detection System for Connected Vehicles

Abstract

In this paper, we propose an intrusion detection system based on the estimation of the Rényi entropy with multiple orders. The Rényi entropy is a generalized notion of entropy that includes the Shannon entropy and the min-entropy as special cases. In 2018, Kim proposed an efficient estimation method for the Rényi entropy with an arbitrary real order α . In this work, we utilize this method to construct a multiple order, Rényi entropy based intrusion detection system (IDS) for vehicular systems with various network connections. The proposed method estimates the Rényi entropies simultaneously with three distinct orders, two, three, and four, based on the controller area network (CAN)-IDs of consecutively generated frames. The collected frames are split into blocks with a fixed number of frames, and the entropies are evaluated based on these blocks. For a more accurate estimation against each type of attack, we also propose a retrospective sliding window method for decision of attacks based on the estimated entropies. For fair comparison, we utilized the CAN-ID attack data set generated by a research team from Korea University. Our results show that the proposed method can show the false negative and positive errors of less than 1% simultaneously.

On the Application of Entropy Measures with Sliding Window for Intrusion Detection in Automotive In-Vehicle Networks

“…The limit for is the Shannon Entropy defined above. In this paper, we adopt the values of as these are the range of values used in the literature [ 9 ].…”

“…A similar approach is used for SaEn and FzEn and a value of is used. Finally, the values of for ReEn are (1–4) as they are the same values adopted in [ 9 ] and it was experimentally found that values of greater than 4 did not significantly improve detection.…”

“…Another significant difference of this paper in comparison to the previous references [ 3 , 9 , 13 ] is that the analysis is performed on the payload rather than the CAN-ID. This approach is proposed both to address a gap in the literature (mostly focused on the analysis of the CAN-ID) and to evaluate if the information theory approach can be applied to payload analysis and to address the threat where an attacker masquerades the injected traffic using a legitimate ID already present in the in-vehicle network.…”

“…The second method (adopted in this paper) can benefit from the specific characteristics of in-vehicle automotive networks. As highlighted in [ 9 ], one of the most relevant differences between conventional communication networks and vehicular networks in the viewpoint of IDS is that messages generated and transmitted in in-vehicle networks have uniform and regular characteristics, because the traffic usually conveys control or status information of the vehicle, unlike those made by network users over general networks. Because the estimation is made by determining whether the abnormal phenomenon is normally deviated from the specific pattern of normal traffic, the probability of error can be reduced, compared to general communication networks.…”

“…A very recent paper, which adopts a different entropy measure from the previous papers is [ 9 ] where the Renyi Entropy of order 2, 3 and 4 is used to detect a DoS and Fuzzy attack for different values of the sliding window. This paper is also based on a similar methodology to [ 9 ], but it takes in consideration a much larger set of entropy measures including Renyi Entropy.…”