The Hybrid Similar Neighborhood Robust Factorization Machine Model for Can Bus Intrusion Detection in the In-Vehicle Network

Abstract

Controller area network (CAN) is the most commonly used bus technology for In-vehicle network and uses multicast communication without corresponding security measures. Therefore, the message data field is vulnerable to tampering and other attacks. Recent machine learning-based intrusion detection methods for CAN bus messages only use the information contained in the message data field and do not take into account the contribution made by the neighboring information of CAN bus messages. In addition, previous models considered the data domain information of CAN bus messages as separate features and did not consider the unique weight of each feature, as well as the second-order interaction information between features. Therefore, we propose a novel intrusion detection model, The Hybrid Similar Neighborhood Robust Factorization Machine Model (HSNRFM), for detecting anomalies in CAN bus messages to address the shortcomings and problems of the previous models. To be able to incorporate the contribution of similar neighborhood information and learn the unique weight parameters of each feature in the model decision process, as well as additional second-order interaction information between features, the HSNRFM model solves the above problem using a similarity calculation method and a factorization machine model. Comprehensive experimental results are compared on real vehicle datasets. The HSNRFM model has AUC values of 0.9216 and 0.901 and AUPR values of 0.9194 and 0.9018 on two real datasets, respectively. And the results show that our proposed HSNRFM model has excellent detection efficiency for intrusion detection of CAN bus messages.