Comparative Performance Evaluation of Intrusion Detection Based on Machine Learning in In-Vehicle Controller Area Network Bus

Abstract

Communication between the nodes in a vehicle is performed using many protocols. The most common of these is known as the Controller Area Network (CAN). The functionality of the CAN protocol is based on sending messages from one node to all others throughout a bus. Messages are sent without either source or destination addresses. Consequently, it is simple for an attacker to inject malicious messages. This may lead to some nodes malfunctioning or to total system failure, which can affect the safety of the driver as well as the vehicle. Detecting intrusions is a challenging problem when using a CAN bus protocol for in-vehicle communication. Most existing work focuses on the physical aspects without taking into consideration the data itself. Machine Learning (ML) tools, especially classification techniques, have been widely used to address similar problems. In this paper, we use and compare several ML techniques to deal with the problem of detecting intrusions in in-vehicle communication. An experimental study is performed using a real dataset extracted from a KIA Soul car. Compared to previous work, which focuses on detecting intrusions based on the physical aspect, in this paper, data analysis and statistical learning techniques are applied. Furthermore, the paper provides a comparative study of the most common ML techniques. The results show that the techniques proposed in this paper outperform other techniques that have been used previously.

AI-Based Intrusion Detection Systems for In-Vehicle Networks: A Survey

“…Similarly, Alfardus and Rawat [6] also used ML algorithms such as KNN, RF, SVM, and Multilayer Perceptron (MLP) to detect CAN bus attacks. Moulahi et al [114] used RF, DT, SVM, and MLP to compare the detection capability. Features related to time, ID, DLC, and payload values were used.…”

“…The main objective of the proposed approach was to identify vehicle models and anomalies. All of these works [6,10,11,35,70,113,114,129] can be considered as basic ML and DL model comparisons for CAN attacks. None of these models has the capability to detect unknown attacks.…”

Detecting In-vehicle Intrusion via Semi-supervised Learning-based Convolutional Adversarial Autoencoders

“…Similar to DCNN, the proposed models are extremely complicated to deploy in real life. Conversely, in [16], simple machine learning models are used for faster training and inference. However, the models achieve low accuracy, particularly for DoS and fuzzy attacks.…”

Android Head Units vs. In-Vehicle ECUs: Performance Assessment for Deploying In-Vehicle Intrusion Detection Systems for the CAN Bus

“…A hierarchical taxonomy on these methodologies can be found in [31]. The authors from [32] provide a comparative view regarding the use of machine learning approaches for CAN IDSs. For example, in [33], the authors evaluate the performance of the K-Nearest Neighbour and Support Vector Machine algorithms against Denial of Service (DoS) and fuzzy attacks.…”