Detection of cybersecurity spoofing attacks in vehicular networks with recurrence quantification analysis

Abstract

Cybersecurity aspects in modern automotive vehicles are becoming increasingly important due to the recent demonstration of successful cybersecurity attacks. Intrusion Detection System (IDS) is one of the approaches proposed in the research literature to detect such attacks. This paper proposes a novel IDS approach based on the application of Recurrence Quantification Analysis (RQA), in combination with a sliding window, to the information of the CAN-bus message arrival time, which has the benefit of not requiring the processing of the arbitration field or the payload data of the CAN-bus message. The rationale for the application of RQA to this problem is to consider the in-vehicle network as a dynamic system where the CAN-bus message time is used as an observable. This approach is evaluated with various machine learning algorithms on two public data sets recently published by the research community with a focus on spoofing attacks since they are the most difficult to detect. The proposed approach is compared with the application of entropy measures for attack detection, which are commonly adopted in the literature and with the results from the literature on the same data sets. The results show that the RQA based approach provides a better detection accuracy than entropy measures in a consistent way across different sliding window sizes in both data sets and it is competitive against other approaches in the literature. This paper provides also an extensive evaluation of the impact on detection accuracy of the sliding window size and the hyper-parameters present in the definition of RQA and the machine learning algorithms.