In-vehicle Network Research Articles

Semi-Supervised Intrusion Detection System for In-Vehicle Networks Based on Variational Autoencoder and Adversarial Reinforcement Learning

Despite the affordability, simplicity, and efficiency of controller area network (CAN) protocols, the security vulnerability remains a major challenge. Currently, a machine learning-based intrusion detection system (IDS) is considered an effective approach for improving security in CAN by identifying malicious attacks. However, earlier studies that relied on supervised learning methods required considerable amounts of labeled data. Data collection from vehicles is time-consuming and expensive. Furthermore, the obtained data exhibited a class imbalance, which presents further challenges in the analysis and model training. Thus, we propose a semi-supervised learning-based IDS that combines variational autoencoder (VAE) and adversarial reinforcement learning for the multi-class classification of both known and unknown attacks. The proposed system capitalizes on the diverse patterns inherent in unlabeled data, transforming this data space into one that is more conducive to classification. Concurrently, adversarial agents in the reinforcement learning algorithm interact competitively, progressively enhancing their ability to intelligently classify and select samples. To reduce the reliance on labeled data and effectively exploit them, we utilize a pseudo-labeling process for pre-training. Experimental results indicate that the proposed model achieves more effective classification while requiring less labeled data compared to other baseline models for known attacks. By inheriting the advantages of VAE, promising results demonstrate that the proposed system detects unknown attacks containing similar or completely different characteristics with high F1 scores exceeding 0.9 and 0.84, respectively. Finally, the proposed system was demonstrated to be a lightweight model for the expeditious detection of malevolent messages introduced into in-vehicle networks to ensure minimal latency.

BIDS: An efficient Intrusion Detection System for in-vehicle networks using a two-stage Binarised Neural Network on low-cost FPGA

Automotive networks are crucial for ensuring safety as the number of Electronic Control Units (ECUs) grows to support vehicle intelligence. The Controller Area Network (CAN) is commonly used for efficient in-vehicle communication among ECUs. However, its broadcast nature and lack of a dedicated security layer make it vulnerable to attacks. This paper proposes a novel CAN bus Intrusion Detection System (IDS), named BNN-based IDS (BIDS), which efficiently provides both unknown attack detection and known attack classification using a hierarchical two-stage Binarised Neural Network (BNN) and Generative Adversarial Network (GAN). BIDS was validated on three datasets, and its implementation achieves an average inference time of less than 0.170 ms with minimal resource utilisation on a low-cost Field Programmable Gate Array (FPGA). This rapid inference speed enables real-time inference on individual CAN messages using a sliding window technique, eliminating the need to wait for multiple accumulated CAN messages required for data preprocessing. Evaluation metrics demonstrate that our IDS achieves high accuracy in both identifying unseen attacks and categorising known attacks. Furthermore, our FPGA implementation consumes merely 2.09 W, which is a 57% reduction compared to a cutting-edge FPGA-based IDS that is capable of detecting unknown attacks using the same dataset.

Network anomaly detection in cars: A case for time-sensitive stream filtering and policing

Connected vehicles are threatened by cyber-attacks as in-vehicle networks technologically approach (mobile) LANs with several wireless interconnects to the outside world. Malware that infiltrates a car today faces potential victims of constrained, barely shielded Electronic Control Units (ECUs). Many ECUs perform critical driving functions, which stresses the need for hardening security and resilience of in-vehicle networks in a multifaceted way. Future vehicles will comprise Ethernet backbones that differentiate services via Time-Sensitive Networking (TSN). The well-known vehicular control flows will follow predefined schedules and TSN traffic classifications. In this paper, we exploit this traffic classification to build a network anomaly detection system. We show how filters and policies of TSN can identify misbehaving traffic and thereby serve as distributed guards on the data link layer. On this lowest possible layer, our approach derives a highly efficient network protection directly from TSN. We classify link layer anomalies and micro-benchmark the detection accuracy in each class. Based on a topology derived from a real-world car and its traffic definitions we evaluate the detection system in realistic macro-benchmarks based on recorded attack traces. Our results show that the detection accuracy depends on how exact the specifications of in-vehicle communication are configured. Most notably for a fully specified communication matrix, our anomaly detection remains free of false-positive alarms, which is a significant benefit for implementing automated countermeasures in future vehicles.

Gradient correlation based detection of adversarial attacks on vehicular networks

The controller area network (CAN) bus, which controls real-time communication and data transmission among vehicle electronic control units, lacks security mechanisms and is highly vulnerable to attacks. Existing in-vehicle network intrusion detection systems (IDSs) typically rely on deep learning models for detection, which are susceptible to interference from adversarial attacks owing to the vulnerability of the models themselves, thereby compromising the detection performance. In this study, we propose an adversarial attack detection method based on gradient correlation that achieves a high accuracy rate using a linear approach to detect adversarial samples. The experimental results show that the proposed model does not require retraining of the original detection model and demonstrates better detection performance for multiple adversarial attacks.

A robust multi-stage intrusion detection system for in-vehicle network security using hierarchical federated learning

As connected and autonomous vehicles proliferate, the Controller Area Network (CAN) bus has become the predominant communication standard for in-vehicle networks due to its speed and efficiency. However, the CAN bus lacks basic security measures such as authentication and encryption, making it highly vulnerable to cyberattacks. To ensure in-vehicle security, intrusion detection systems (IDSs) must detect seen attacks and provide a robust defense against new, unseen attacks while remaining lightweight for practical deployment. Previous work has relied solely on the CAN ID feature or has used traditional machine learning (ML) approaches with manual feature extraction. These approaches overlook other exploitable features, making it challenging to adapt to new unseen attack variants and compromising security. This paper introduces a cutting-edge, novel, lightweight, in-vehicle, IDS-leveraging, deep learning (DL) algorithm to address these limitations. The proposed IDS employs a multi-stage approach: an artificial neural network (ANN) in the first stage to detect seen attacks, and a Long Short-Term Memory (LSTM) autoencoder in the second stage to detect new, unseen attacks. To understand and analyze diverse driving behaviors, update the model with the latest attack patterns, and preserve data privacy, we propose a theoretical framework to deploy our IDS in a hierarchical federated learning (H-FL) environment. Experimental results demonstrate that our IDS achieves an F1-score exceeding 0.99 for seen attacks and exceeding 0.95 for novel attacks, with a detection rate of 99.99%. Additionally, the false alarm rate (FAR) is exceptionally low at 0.016%, minimizing false alarms. Despite using DL algorithms known for their effectiveness in identifying sophisticated and zero-day attacks, the IDS remains lightweight, ensuring its feasibility for real-world deployment. This makes our model robust against seen and unseen attacks.

Review of Risk Assessment Methods for Cybersecurity Attacks on Road Network and Intelligent Transportation System Applications

One of the most discussed infrastructure issues of our time is cybersecurity. A transportation system that connects not only people but also logistics to make the community around the world closer is one of the critical infrastructures requiring cybersecurity to perform its functions. Transportation systems include aviation, maritime, pipeline, railroad, and road networks. This study focuses only on the roadway network system. Cutting-edge technologies related to highway networks, such as variable message signs, vehicular ad hoc networks, and in-vehicle networks, have been developed to improve safety and efficiency. Those technologies make transportation systems more complex and integrated, bringing many potential vulnerabilities and cyber risks. This can attract an adversary to attack and exploit the system. The number of cybersecurity attacks on transportation systems has been growing for many years. However, it is not feasible to protect against all cybersecurity attacks in the system. The risk assessment concept is proposed to prioritize risk resulting from attacks to support decision-makers in formulating appropriate policies or countermeasures. This study reviews risk assessment methods for cybersecurity attacks on road networks and intelligent transportation system applications. Three potential risk assessment methods are examined for road network systems: the National Institute of Standards and Technology Special Publication 800-30, Attack Potential and Damage Potential, and the fuzzy analytic hierarchy process.

An Intelligent Attack Detection Framework for the Internet of Autonomous Vehicles with Imbalanced Car Hacking Data

The modern Internet of Autonomous Vehicles (IoVs) has enabled the development of autonomous vehicles that can interact with each other and their surroundings, facilitating real-time data exchange and communication between vehicles, infrastructure, and the external environment. The lack of security procedures in vehicular networks and Controller Area Network (CAN) protocol leaves vehicles exposed to intrusions. One common attack type is the message injection attack, which inserts fake messages into original Electronic Control Units (ECUs) to trick them or create failures. Therefore, this paper tackles the pressing issue of cyber-attack detection in modern IoV systems, where the increasing connectivity of vehicles to the external world and each other creates a vast attack surface. The vulnerability of in-vehicle networks, particularly the CAN protocol, makes them susceptible to attacks such as message injection, which can have severe consequences. To address this, we propose an intelligent Intrusion detection system (IDS) to detect a wide range of threats utilizing machine learning techniques. However, a significant challenge lies in the inherent imbalance of car-hacking datasets, which can lead to misclassification of attack types. To overcome this, we employ various imbalanced pre-processing techniques, including NearMiss, Random over-sampling (ROS), and TomLinks, to pre-process and handle imbalanced data. Then, various Machine Learning (ML) techniques, including Logistic Regression (LR), Linear Discriminant Analysis (LDA), Naive Bayes (NB), and K-Nearest Neighbors (k-NN), are employed in detecting and predicting attack types on balanced data. We evaluate the performance and efficacy of these techniques using a comprehensive set of evaluation metrics, including accuracy, precision, F1_Score, and recall. This demonstrates how well the suggested IDS detects cyberattacks in external and intra-vehicle vehicular networks using unbalanced data on vehicle hacking. Using k-NN with various resampling techniques, the results show that the proposed system achieves 100% detection rates in testing on the Car-Hacking dataset in comparison with existing work, demonstrating the effectiveness of our approach in protecting modern vehicle systems from advanced threats.

Application of optimizing advanced encryption standard encryption algorithm in secure communication of vehicle controller area network bus

Introduction: As the main means of information exchange within vehicles, the safety of the controller area network bus directly affects the safe operation of the vehicle and the safety of passengers’ lives and property.Methods: To enhance its secure communication function, this study utilizes advanced encryption standard algorithms and improves the S-box of the algorithm to solve problems such as extended processing time. A secure communication system for the local area network bus of the vehicle controller is designed based on optimized advanced encryption standard algorithms.Results and Discussion: The results showed that when the file size was 200MB, the encryption and decryption time spent by the research method was 469.8 s and 528.5 s, respectively, which are significantly lower than traditional methods. In the simulation results, under both non-encrypted and encrypted transmission, the information remained intact throughout the entire transmission process. This indicated that the optimization algorithm effectively reduced encryption processing time and system resource consumption while ensuring data confidentiality and integrity. The new system meets the security requirements of the local area network bus of vehicle-mounted controllers.Conclusion: This study not only enhances the security of in-vehicle networks but also promotes the application and development of related encryption technologies in the field of vehicle networking. It provides strong technical support for the further development of vehicle networking and the safe operation of intelligent vehicles.

IDS-DEC: A novel intrusion detection for CAN bus traffic based on deep embedded clustering

As the automotive industry advances towards greater automation, the proliferation of electronic control units (ECUs) has led to a substantial increase in the connectivity of in-vehicle networks with the external environment. However, the widely used Controller Area Network (CAN), which serves as the standard for in-vehicle networks, lacks robust security features, such as authentication or encrypted information transmission. This poses a significant challenge to the security of these networks. Despite the availability of powerful intrusion detection methods based on machine learning and deep learning, there are notable limitations in terms of stability and accuracy in the absence of a supervised learning process with labeled data. To address this issue, this paper introduces a novel in-vehicle intrusion detection system, termed IDS-DEC. This system combines a spatiotemporal self-coder employing LSTM and CNN (LCAE) with an entropy-based deep embedding clustering. Specifically, our approach involves encoding in-vehicle network traffic into windowed messages using a stream builder, designed to adapt to high-frequency traffic. These messages are then fed into the LCAE to extract a low-dimensional nonlinear spatiotemporal mapping from the initially high-dimensional data. The resulting low-dimensional mapping is subjected to a dual constraint in conjunction with our entropy-based pure deep embedding clustering module. This creates a bidirectional learning objective, addressing the optimization problem and facilitating an end-to-end training pattern for our model to adapt to diverse attack environments. The effectiveness of IDS-DEC is validated using both the benchmark Car Hacking dataset and the Car Hacking-Attack & Defense Challenge dataset. Experimental results demonstrate the model's high detection accuracy across various attacks, stabilizing at approximately 99% accuracy with a 0.5% false alarm rate. The F1 score also stabilizes at around 99%. In comparison with unsupervised methods based on deep stream clustering, LSTM-based self-encoder, and classification-based methods, IDS-DEC exhibits significant improvements across all performance metrics.

Efficient Task Offloading for Mobile Edge Computing in Vehicular Networks

In vechcular networks, a promising approach to enhance vehicle task processing capabilities involves using a combination of roadside base stations or vehicles, there are two challenges when integrating the two offloading modeth: 1) the high mobility of vehicles can easily lead to connectivity interruptions between nodes, which in turn affects the processing of the tasks that are being offloaded; and 2) vehicles on the road are not completely trustworthy, and vehicle tasks that contain private information may suffer from result errors or privacy leakage and other problems. This paper investigates the computing offloading problem for minimizing task completion delay in vehicular networks. Specifically, we design a trust model for mobile in-vehicle networks and construct a migration decision problem to minimize the overall delay of task execution for all vehicle users. The simulation results show that the scheme proposed in this paper can effectively reduce the execution delay of the task compared to the baseline scheme.

Engineering Autonomous Mobility: Wired and Wireless CAN Bus Design Principles

<div>The controller area network (CAN) bus, the prevailing standard for in-vehicle networking (IVN), has been used for more than four decades, despite its simple architecture, to establish communications between electronic control units (ECUs). Weight, maintenance overheads, improved flexibility, and wiring complexity escalate as the quantity of ECUs rises, especially for high-demand autonomous vehicles (AVs). The primary objective of this study is to examine and discuss the significant challenges that arise during the migration from a wired CAN to a wireless CAN (WCAN). Suggested remedies include changing the configuration of the conventional ECU, creating a hidden wireless communication domain for each AV, and developing a plan to counteract the jamming signals. The simulation of the proposed WCAN was done using MATLAB and validated using OPNET analysis. The results showed that the packet loss of the eavesdropping electronic control unit ranged from 63% to 100%. Anti-jamming results show that when packet loss reaches 2% for a continuous period of time of 0.01 sec, the passive channel is automatically activated, ensuring secure data transmission.</div>

Reconfigurable CAN Intrusion Detection and Response System

The controller area network (CAN) remains the de facto standard for intra-vehicular communication. CAN enables reliable communication between various microcontrollers and vehicle devices without a central computer, which is essential for sustainable transportation systems. However, it poses some serious security threats due to the nature of communication. According to caranddriver.com, there were at least 150 automotive cybersecurity incidents in 2019, a 94% year-over-year increase since 2016, according to a report from Upstream Security. To safeguard vehicles from such attacks, securing CAN communication, which is the most relied-on in-vehicle network (IVN), should be configured with modifications. In this paper, we developed a configurable CAN communication protocol to secure CAN with a hardware prototype for rapidly prototyping attacks, intrusion detection systems, and response systems. We used a field programmable gate array (FPGA) to prototype CAN to improve reconfigurability. This project focuses on attack detection and response in the case of bus-off attacks. This paper introduces two main modules: the multiple generic errors module with the introduction of the error state machine (MGEESM) module and the bus-off attack detection (BOAD) module for a frame size of 111 bits (BOAD111), based on the CAN protocol presenting the introduction of form error, CRC error, and bit error. Our results show that, in the scenario with the transmit error counter (TEC) value 127 for switching between the error-passive state and bus-off state, the detection times for form error, CRC error, and bit error introduced in the MGEESM module are 3.610 ms, 3.550 ms, and 3.280 ms, respectively, with the introduction of error in consecutive frames. The detection time for BOAD111 module in the same scenario is 3.247 ms.

Anomaly Detection for In-Vehicle Network Using Self-Supervised Learning With Vehicle-Cloud Collaboration Update

Anomaly Detection for In-Vehicle Network Using Self-Supervised Learning With Vehicle-Cloud Collaboration Update

Multi-order feature interaction-aware intrusion detection scheme for ensuring cyber security of intelligent connected vehicles

The evolution of technology has raised concerns regarding cybersecurity for intelligent connected vehicles (ICVs). In-vehicle network in ICVs lacks robust protection mechanisms, making it vulnerable to cyber threats. In response, intrusion detection systems (IDSs) for ICVs have been developed to protect vehicles from malicious cyber attacks. However, current IDS methods solely rely on independent features, limiting their learning capabilities and increasing the number of false detections. Moreover, many IDSs require the knowledge of mapping between network messages and contents, which restricts their application. To address these limitations, we propose the Multi-order Feature Interaction-aware Intrusion Detection (MIFI) scheme for ICVs. Feature attention cross network is designed to address higher-order feature interactions, while factorization machine is used for second-order interactions. Then a discriminator is utilized to detect the attacks. MIFI expands the feature space through features interaction, thereby enhancing its ability to detect attacks. Moreover, it perceives the relationships of vehicle messages, facilitating intrusion detection without knowing the corresponding rules of vehicle messages. The performance of the proposed method is evaluated on two real-vehicle datasets, affirming its effectiveness and robustness. MIFI achieves an accuracy of over 99% in detecting different attacks. The proposed method can improve the accuracy of traditional IDS to a maximum of 99.99%, and increase the highest F1-score to 97.18%, demonstrating the model’s ability of achieving multi-order feature interactions. Ultimately, MIFI is suitable for intrusion detection in different types of ICV networks, significantly contributing to the cybersecurity of ICVs.

Study of Fixed Point Message Scheduling Algorithm for In-Vehicle Ethernet

With the rapid development of advanced driver assistance systems (ADASs) and autonomous driving technology, in-vehicle networks are facing huge challenges in real-time operation and data loss. Traditional vehicle bus network systems such as LIN, CAN, and FlexRay are insufficient to meet the real-time requirements of intelligent connected vehicles. In-vehicle Ethernet meets the requirements of high reliability, low electromagnetic radiation, low power consumption, bandwidth allocation, low latency, and real-time synchronization of intelligent connected vehicles. In-vehicle Ethernet has become one of the trends in the next generation of in-vehicle network architecture. This research focuses on the delay problem existing in the real-time data transmission process of in-vehicle Ethernet, and innovatively proposes a fixed point message scheduling algorithm (FPMS) based on time-sensitive network (TSN) technology. By building an experimental platform based on the CANoe simulation tool, the high-efficiency message transmission performance of the fixed point message scheduling algorithm was verified. Experimental results show that the fixed point message scheduling algorithm proposed in this study improves message transmission efficiency by 66%, laying a solid foundation for improving the real-time and reliability performance of in-vehicle Ethernet.

HP-LSTM: Hawkes Process–LSTM-Based Detection of DDoS Attack for In-Vehicle Network

Connected and autonomous vehicles (CAVs) are advancing at a fast speed with the improvement of the automotive industry, which opens up new possibilities for different attacks. A Distributed Denial-of-Service (DDoS) attacker floods the in-vehicle network with fake messages, resulting in the failure of driving assistance systems and impairment of vehicle control functionalities, seriously disrupting the normal operation of the vehicle. In this paper, we propose a novel DDoS attack detection method for in-vehicle Ethernet Scalable service-Oriented Middleware over IP (SOME/IP), which integrates the Hawkes process with Long Short-Term Memory networks (LSTMs) to capture the dynamic behavioral features of the attacker. Specifically, we employ the Hawkes process to capture features of the DDoS attack, with its parameters reflecting the dynamism and self-exciting properties of the attack events. Subsequently, we propose a novel deep learning network structure, an HP-LSTM block, inspired by the Hawkes process, while employing a residual attention block to enhance the model’s detection efficiency and accuracy. Additionally, due to the scarcity of publicly available datasets for SOME/IP, we employed a mature SOME/IP generator to create a dataset for evaluating the validity of the proposed detection model. Finally, extensive experiments were conducted to demonstrate the effectiveness of the proposed DDoS attack detection method.

Analysis of E2E Delay and Wiring Harness in In-Vehicle Network with Zonal Architecture.

With recent advances in vehicle technologies, in-vehicle networks (IVNs) and wiring harnesses are becoming increasingly complex. To solve these challenges, the automotive industry has adopted a new zonal-based IVN architecture (ZIA) that connects electronic control units (ECUs) according to their physical locations. In this paper, we evaluate how the number of zones in the ZIA affects the end-to-end (E2E) delay and the characteristics of the wiring harnesses. We evaluate the impact of the number of zones on E2E delay through the OMNeT++ network simulator. In addition, we theoretically predict and analyze the impact of the number of zones on the wiring harnesses. Specifically, we use an asymptotic approach to analyze the total length and weight evolution of the wiring harnesses in ZIAs with 2, 4, 6, 8, and 10 zones by incrementally increasing the number of ECUs. We find that as the number of zones increases, the E2E delay increases, but the total length and weight of the wiring harnesses decreases. These results confirm that the ZIA effectively uses the wiring harnesses and mitigates network complexity within the vehicle.

Machine Learning-Based Anomaly Detection for Securing In-Vehicle Networks

Machine Learning-Based Anomaly Detection for Securing In-Vehicle Networks

Fast and efficient context-aware embedding generation using fuzzy hashing for in-vehicle network intrusion detection

In the rapidly advancing field of automotive cybersecurity, the protection of In-Vehicle Networks (IVNs) against cyber threats is crucial. Current deep learning solutions offer robustness but at the cost of high computational demand and potential privacy breaches due to the extensive IVN data required for model training. Our study proposes a novel intrusion detection system (IDS) specifically designed for IVNs that prioritizes computational efficiency and data privacy. Utilizing fuzzy hashing techniques, we generate context-aware embeddings that effectively preserve the privacy of IVN data. Among the machine learning algorithms evaluated, the Support Vector Machine (SVM) emerged as the most effective, particularly when paired with TLSH hash embeddings. This combination achieved notable detection performance, as substantiated by T-SNE visualizations that demonstrate a distinct segregation of normal and attack traffic within the vector space. To validate the effectiveness and practicality of our proposed IDS, we conducted exhaustive experiments on the well-known car-hacking dataset and the more complex ROAD dataset, which includes diverse and sophisticated attack scenarios. Our findings reveal that the proposed lightweight IDS not only demonstrates high detection accuracy but also maintains this performance within the computational constraints of current IVN systems. The system's capability to operate effectively in real-time environments makes it a viable solution for modern automotive cybersecurity needs.

Multi-stage deep learning-based intrusion detection system for automotive Ethernet networks

Modern automobiles are increasing the demand for automotive Ethernet as a high-bandwidth and flexible in-vehicle network technology. However, since Ethernet does not have native support for authentication or encryption, intrusion detection systems (IDSs) are becoming an attractive security mechanism to detect malicious activities that may affect Ethernet-based communication in cars. This paper proposes a novel multi-stage deep learning-based intrusion detection system to detect and classify cyberattacks in automotive Ethernet networks. The first stage uses a Random Forest classifier to detect cyberattacks quickly. The second stage, on the other hand, uses a Pruned Convolutional Neural Network that minimizes false positive rates while classifying different types of cyberattacks. We evaluate our proposed IDS using two publicly available automotive Ethernet intrusion datasets. The experimental results show that our proposed solution detects cyberattacks with a similar detection rate and a faster detection time compared to other state-of-the-art baseline automotive Ethernet IDSs.