Investigating BiLSTM-based intrusion detection for CAN: cross-vehicles and unknown attacks

ML-based intrusion detection systems (IDS) have been increasingly used for the security of in-vehicle Controller Area Network (CAN). These IDSs are generally evaluated in familiar settings of vehicles or attack types in simulated or lab environments. We propose a modular IDS based on bidirectional long short-term memory (BiLSTM) with two modules: a detector for anomaly detection and a classifier for attack type classification, trained on a dataset collected live on-the-road. The proposed IDS uses fixed-length sliding windowed inputs to learn temporal dependencies in CAN traffic to detect and classify intrusions. We present a systematic experimentation on the proposed IDS based on vehicle familiarity (known/unknown during training) and attack familiarity for structured assessment. The output conflict between detector and classifier can be used for identifying unseen attacks during training. Results show reliable performance when familiarity in vehicle and attack exists, but near-random behavior when unfamiliarity in both vehicle and attack exists.

Content

Subjects

Controller Area Network

Intrusion Detection

Machine Learning

Bidirectional LSTM

Cross-Vehicle

Unknown Attacks

DDC Class

005.8: Computer Security

006.31: Machine Learning

620: Engineering

Files

Lizenz

http://rightsstatements.org/vocab/InC/1.0/

Publication version

acceptedVersion

Request a copy

Name

AIoTS26_Investigating BiLSTM-based IDS for CAN_Tiramdas_Fröschle.pdf

Size

1.76 MB

Format

Adobe PDF