DESC-IDS: Towards an efficient real-time automotive intrusion detection system based on deep evolving stream clustering

Cheng, Pengzhou; Han, Mu; Liu, Gongshen

doi:10.1016/j.future.2022.10.020

Cited by 11 publications

(3 citation statements)

References 24 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Another key aspect of introducing the research community to the ROAD dataset is that it provides a quality platform to test novel IDS architectures. In [37,[71][72][73][74][75][76][77][78], researchers use the ROAD dataset for evaluation purposes from a novel IDS method. Jin et al combine oversampling, outlier detection, and metric learning for intrusion detection and evaluate their model on ROAD (and other datasets) [71].…”

Section: Plos Onementioning

confidence: 99%

“…The potential of embedding an IDS that utilizes characteristic functions is proposed in [ 79 ], where researchers evaluate the cybersecurity framework on ROAD. In [ 77 ], researchers utilize the ROAD dataset to validate a model called “Deep Evolving Stream Clustering- IDS” or DESC-IDS. Cheng et al propose the model as a means of anomaly detection capable of reducing data complexity for constructing spatial-temporal features and exposing attacks.…”

Section: Introducing the Road Datasetmentioning

confidence: 99%

See 1 more Smart Citation

A comprehensive guide to CAN IDS data and introduction of the ROAD dataset

Verma,

Bridges,

Iannacone

et al. 2024

PLoS ONE

View full text Add to dashboard Cite

Although ubiquitous in modern vehicles, Controller Area Networks (CANs) lack basic security properties and are easily exploitable. A rapidly growing field of CAN security research has emerged that seeks to detect intrusions or anomalies on CANs. Producing vehicular CAN data with a variety of intrusions is a difficult task for most researchers as it requires expensive assets and deep expertise. To illuminate this task, we introduce the first comprehensive guide to the existing open CAN intrusion detection system (IDS) datasets. We categorize attacks on CANs including fabrication (adding frames, e.g., flooding or targeting and ID), suspension (removing an ID’s frames), and masquerade attacks (spoofed frames sent in lieu of suspended ones). We provide a quality analysis of each dataset; an enumeration of each datasets’ attacks, benefits, and drawbacks; categorization as real vs. simulated CAN data and real vs. simulated attacks; whether the data is raw CAN data or signal-translated; number of vehicles/CANs; quantity in terms of time; and finally a suggested use case of each dataset. State-of-the-art public CAN IDS datasets are limited to real fabrication (simple message injection) attacks and simulated attacks often in synthetic data, lacking fidelity. In general, the physical effects of attacks on the vehicle are not verified in the available datasets. Only one dataset provides signal-translated data but is missing a corresponding “raw” binary version. This issue pigeon-holes CAN IDS research into testing on limited and often inappropriate data (usually with attacks that are too easily detectable to truly test the method). The scarcity of appropriate data has stymied comparability and reproducibility of results for researchers. As our primary contribution, we present the Real ORNL Automotive Dynamometer (ROAD) CAN IDS dataset, consisting of over 3.5 hours of one vehicle’s CAN data. ROAD contains ambient data recorded during a diverse set of activities, and attacks of increasing stealth with multiple variants and instances of real (i.e. non-simulated) fuzzing, fabrication, unique advanced attacks, and simulated masquerade attacks. To facilitate a benchmark for CAN IDS methods that require signal-translated inputs, we also provide the signal time series format for many of the CAN captures. Our contributions aim to facilitate appropriate benchmarking and needed comparability in the CAN IDS research field.

show abstract

Section: Plos Onementioning

confidence: 99%

Section: Introducing the Road Datasetmentioning

confidence: 99%

A comprehensive guide to CAN IDS data and introduction of the ROAD dataset

Verma,

Bridges,

Iannacone

et al. 2024

PLoS ONE

View full text Add to dashboard Cite

show abstract

“…(ii) Most packetbased NIDS do not consider the sequential functioning of packets in a flow and instead treat them as independent packets. As a result, the temporal correlations among the packets belonging to the flows are not captured [6], which may result in an incorrect classification by the NIDS (iii) They do not consider the direction of packets due to independence assumptions. However, the direction of a packet in a flow (forward or backward) can provide significant information in identifying attacks.…”

Section: Introductionmentioning

confidence: 99%

Towards Real-time Network Intrusion Detection with Image-based Sequential Packets Representation

Ghadermazi,

Shah,

Bastian

2024

IEEE Trans. Big Data

View full text Add to dashboard Cite

Machine learning (ML) and deep learning (DL) advancements have greatly enhanced anomaly detection of network intrusion detection systems (NIDS) by empowering them to analyze big data and extract patterns. ML/DL-based NIDS are trained using either flow-based or packet-based features. Flow-based NIDS are suitable for offline traffic analysis, while packet-based NIDS can analyze traffic and detect attacks in real-time. Current packet-based approaches analyze packets independently, overlooking the sequential nature of network communication. This results in biased models that exhibit increased false negatives and positives.Additionally, most literature-proposed packet-based NIDS capture only payload data, neglecting crucial information from packet headers. This oversight can impair the ability to identify header-level attacks, such as denial-of-service attacks. To address these limitations, we propose a novel artificial intelligence-enabled methodological framework for packet-based NIDS that effectively analyzes header and payload data and considers temporal connections among packets. Our framework transforms sequential packets into two-dimensional images. It then develops a convolutional neural network-based intrusion detection model to process these images and detect malicious activities. Through experiments using publicly available big datasets, we demonstrate that our framework is able to achieve high detection rates of 97.7% to 99% across different attack types and displays promising resilience against adversarial examples.

show abstract