Optimised Structure of Convolutional Neural Networks for Controller Area Network Classification

Lokman, Siti-Farhana; Othman, Abu Talib; Bakar, Muhamad Husaini Abu

doi:10.1109/fskd.2018.8687274

Cited by 5 publications

(5 citation statements)

References 16 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…These mechanisms discriminate groups of messages associated with attacks and those that are not, with acceptable accuracy and false positive [19]. Neural Networks (NN) has been the commonly used ML-based approach for designing IDSs for the CAN bus, e.g., [20], [21], [22], [23]. In previous work [10], [11] we used machine learning techniques to develop IDSs for connected vehicles including Hodden Markov Model (HMM), Long Short-Term Memory (LSTM), cosine graph-similarity, and change-point detection and evaluated them using CAN data extracted from a moving vehicle under malicious RPM and speed readings messages injections into the in-vehicle network of the vehicles.…”

Section: Related Workmentioning

confidence: 99%

Evaluation of the Architecture Alternatives for Real-time Intrusion Detection Systems for Connected Vehicles

Jedh¹,

Lee²,

Othmane³

2022

Preprint

View full text Add to dashboard Cite

Attackers demonstrated the use of remote access to the in-vehicle network of connected vehicles to launch cyber-attacks and remotely take control of these vehicles. Machine-learning-based Intrusion Detection Systems (IDSs) techniques have been proposed for the detection of such attacks. The evaluation of some of these IDS demonstrated their efficacy in terms of accuracy in detecting message injections but was performed offline, which limits the confidence in their use for real-time protection scenarios. This paper evaluates four architecture designs for real-time IDS for connected vehicles using Controller Area Network (CAN) datasets collected from a moving vehicle under malicious speed reading message injections. The evaluation shows that a realtime IDS for a connected vehicle designed as two processes, a process for CAN Bus monitoring and another one for anomaly detection engine is reliable (no loss of messages) and could be used for real-time resilience mechanisms as a response to cyber-attacks.

show abstract

Section: Related Workmentioning

confidence: 99%

Evaluation of the Architecture Alternatives for Real-time Intrusion Detection Systems for Connected Vehicles

Jedh¹,

Lee²,

Othmane³

2022

Preprint

View full text Add to dashboard Cite

show abstract

“…At the core of these solution methods is discriminating messages associated to attacks and those that are not, with acceptable accuracy and false positive [32]. Neural Network (NN) has been the commonly used ML-based approach for designing IDSs for the CAN bus, e.g., [33], [34], [35], [11]. The main problem with this supervised learning method is that it requires extensive time to develop high-performance IDS models from labeled data [11] and the trained models are specific for vehicle' make and model, and driver.…”

Section: Related Workmentioning

confidence: 99%

Detection of Message Injection Attacks Onto the CAN Bus Using Similarities of Successive Messages-Sequence Graphs

Jedh

Othmane

Ahmed

et al. 2021

IEEE Trans.Inform.Forensic Secur.

View full text Add to dashboard Cite

The smart features of modern cars are enabled by a number of Electronic Control Units (ECUs) components that communicate through an in-vehicle network, known as Controller Area Network (CAN) bus. The fundamental challenge is the security of the communication link where an attacker can inject messages (e.g., increase the speed) that may impact the safety of the driver. Most of existing practical IDS solutions rely on the knowledge of the identity of the ECUs, which is proprietary information. This paper proposes a message injection attack detection solution that is independent of the IDs of the ECUs. First, we represent the sequencing of the messages in a given time-interval as a direct graph and compute the similarities of the successive graphs using the cosine similarity and Pearson correlation. Then, we apply threshold, change point detection, and Long Short-Term Memory (LSTM)-Recurrent Neural Network (RNN) to detect and predict malicious message injections into the CAN bus. The evaluation of the methods using a dataset collected from a moving vehicle under malicious RPM and speed reading message injections show a detection accuracy of 97.32% and detection speed of 2.5 milliseconds when using a threshold method. The performance metrics makes the IDS suitable for real-time control mechanisms for vehicle resiliency to cyber attacks.

show abstract

“…The transformation of chosen network traffic features into a vector that later becomes the CNN deep learning model input is a core part of Refs. [36][37][38][120][121][122]. These papers used network traffic datasets with explicitly traffic features, or extracted them from flow, pcap based datasets.…”

Section: One-dimensional Cnn Inputmentioning

confidence: 99%

“…The CNN model is given a vector, which consists of Can 2017 dataset features, which were collected from in-vehicle on-board diagnostics [121]. The article of Lokman et al considered malware and intrusion detections with the advantage of 4-Layer CDM.…”

Section: One-dimensional Cnn Inputmentioning

confidence: 99%

Data Transformation Schemes for CNN-Based Network Traffic Analysis: A Survey

2021

View full text Add to dashboard Cite

The enormous growth of services and data transmitted over the internet, the bloodstream of modern civilization, has caused a remarkable increase in cyber attack threats. This fact has forced the development of methods of preventing attacks. Among them, an important and constantly growing role is that of machine learning (ML) approaches. Convolutional neural networks (CNN) belong to the hottest ML techniques that have gained popularity, thanks to the rapid growth of computing power available. Thus, it is no wonder that these techniques have started to also be applied in the network traffic classification domain. This has resulted in a constant increase in the number of scientific papers describing various approaches to CNN-based traffic analysis. This paper is a survey of them, prepared with particular emphasis on a crucial but often disregarded aspect of this topic—the data transformation schemes. Their importance is a consequence of the fact that network traffic data and machine learning data have totally different structures. The former is a time series of values—consecutive bytes of the datastream. The latter, in turn, are one-, two- or even three-dimensional data samples of fixed lengths/sizes. In this paper, we introduce a taxonomy of data transformation schemes. Next, we use this categorization to describe various CNN-based analytical approaches found in the literature.

show abstract

Optimised Structure of Convolutional Neural Networks for Controller Area Network Classification

Cited by 5 publications

References 16 publications

Evaluation of the Architecture Alternatives for Real-time Intrusion Detection Systems for Connected Vehicles

Evaluation of the Architecture Alternatives for Real-time Intrusion Detection Systems for Connected Vehicles

Detection of Message Injection Attacks Onto the CAN Bus Using Similarities of Successive Messages-Sequence Graphs

Data Transformation Schemes for CNN-Based Network Traffic Analysis: A Survey

Contact Info

Product

Resources

About