Intrusion Response System for Vehicles: Challenges and Vision

Hamad, Mohamad; Tsantekidis, Marinos; Prevelakis, Vassilis

doi:10.1007/978-3-030-68028-2_15

Cited by 5 publications

(2 citation statements)

References 28 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Furthermore, our findings provide a foundation for designing response systems in critical-safety environments, such as vehicles, where responding to attacks is as vital as their detection [ 57 ]. Therefore, developing IDS response mechanisms that consider and counteract potential adversarial manipulations is essential for protecting passengers and preventing malicious exploits that could undermine vehicle integrity and safety.…”

Section: Discussionmentioning

confidence: 99%

Adversarial Attacks on Intrusion Detection Systems in In-Vehicle Networks of Connected and Autonomous Vehicles

Aloraini,

Javed,

Rana

2024

Sensors

View full text Add to dashboard Cite

Rapid advancements in connected and autonomous vehicles (CAVs) are fueled by breakthroughs in machine learning, yet they encounter significant risks from adversarial attacks. This study explores the vulnerabilities of machine learning-based intrusion detection systems (IDSs) within in-vehicle networks (IVNs) to adversarial attacks, shifting focus from the common research on manipulating CAV perception models. Considering the relatively simple nature of IVN data, we assess the susceptibility of IVN-based IDSs to manipulation—a crucial examination, as adversarial attacks typically exploit complexity. We propose an adversarial attack method using a substitute IDS trained with data from the onboard diagnostic port. In conducting these attacks under black-box conditions while adhering to realistic IVN traffic constraints, our method seeks to deceive the IDS into misclassifying both normal-to-malicious and malicious-to-normal cases. Evaluations on two IDS models—a baseline IDS and a state-of-the-art model, MTH-IDS—demonstrated substantial vulnerability, decreasing the F1 scores from 95% to 38% and from 97% to 79%, respectively. Notably, inducing false alarms proved particularly effective as an adversarial strategy, undermining user trust in the defense mechanism. Despite the simplicity of IVN-based IDSs, our findings reveal critical vulnerabilities that could threaten vehicle safety and necessitate careful consideration in the development of IVN-based IDSs and in formulating responses to the IDSs’ alarms.

show abstract

Section: Discussionmentioning

confidence: 99%

Adversarial Attacks on Intrusion Detection Systems in In-Vehicle Networks of Connected and Autonomous Vehicles

Aloraini,

Javed,

Rana

2024

Sensors

View full text Add to dashboard Cite

show abstract

“…Several defense techniques that focus on detecting an incoming threat [3] and on applying response strategies [4] have been implemented. Information about detected threats, threat actors, and techniques to analyze and confront such incidents are crucial for the mitigation of potentially harmful incidents.…”

Section: Introductionmentioning

confidence: 99%

Towards Automated Matching of Cyber Threat Intelligence Reports based on Cluster Analysis in an Internet-of-Vehicles Environment

Raptis

Katsini

Alexakos

2021

2021 IEEE International Conference on Cyber Security and Resilience (CSR)

View full text Add to dashboard Cite

Connected and automated vehicles are a transformative technology that is getting closer to maturity and offers many benefits to the Internet-of-Vehicles ecosystem. Considering their multi-diverse nature and the vast amount of data they collect, process, and exchange, they attract varying malicious activities that jeopardize security and safety aspects. Therefore, the successful confrontation of such activities is crucial. When detecting such activities, information about the incoming threat is collected and analyzed during and after the incident. Organizations and security experts use cyber threat intelligence to organize such information. Considering that threats can be related to each other, it is important to provide the security experts with tools that would help them identify and attribute the threats. Towards this direction, in this paper, we present a tool that automatically matches cyber threat intelligence reports based on cluster analysis. Through this tool, the security experts can correlate an incoming attack with previously reported ones and follow similar techniques to analyze it, aiming to speed up the attack attribution process.

show abstract