A Hybrid Anomaly Detection System for Electronic Control Units Featuring Replicator Neural Networks
Due to the steadily increasing connectivity combined with the trend towards autonomous driving, cyber security is essential for future vehicles. The implementation of an intrusion detection system (IDS) can be one building block in a security architecture
- PDF / 2,843,107 Bytes
- 20 Pages / 439.37 x 666.142 pts Page_size
- 33 Downloads / 189 Views
Abstract. Due to the steadily increasing connectivity combined with the trend towards autonomous driving, cyber security is essential for future vehicles. The implementation of an intrusion detection system (IDS) can be one building block in a security architecture. Since the electric and electronic (E/E) subsystem of a vehicle is fairly static, the usage of anomaly detection mechanisms within an IDS is promising. This paper introduces a hybrid anomaly detection system for embedded electronic control units (ECU), which combines the advantages of an efficient specification-based system with the advanced detection measures provided by machine learning. The system is presented for - but not limited to - the detection of anomalies in automotive Controller Area Network (CAN) communication. The second part of this paper focuses on the machine learning aspect of the proposed system. The usage of Replicator Neural Networks (RNN) to detect anomalies in the time series of CAN signals is investigated in more detail. After introducing the working principle of RNNs, the application of this algorithm on time series data is presented. Finally, first evaluation results of a prototypical implementation are discussed. Keywords: Intrusion detection system · Anomaly detection Machine learning · Automotive · Controller Area Network · Time series
1
Introduction
Today, connectivity and highly automated driving are the two major topics pushing the evolution of automotive electronics. Both enable a significant improvement for passenger comfort and safety. However, especially in their combination, connectivity and highly automated driving yields new dangerous scenarios. On the one hand, vehicles become increasingly connected with their environment and other vehicles. New wireless technologies like WiFi, Bluetooth and Car2X communication are installed, which enable new cyber-attack vectors [1–3]. On the c Springer Nature Switzerland AG 2019 K. Arai et al. (Eds.): FICC 2018, AISC 887, pp. 43–62, 2019. https://doi.org/10.1007/978-3-030-03405-4_4
44
M. Weber et al.
other hand, ECUs get more and more control over safety-relevant functions of a vehicle, like braking and steering, in order to realize automated driving. To counter the risk of fatal cyber-attacks, several researchers and leading companies propose a multi-layer security concept [1,4–7]. A so-called defense in depth architecture could e.g. consist of four defense barriers as proposed by Miller and Valasek [1]: (1) Secure off-board communication. (2) Access control for in-vehicle networks. (3) Separation of different domains within the electric and electronic architecture. (4) Mechanisms to detect and prevent cyber-attacks on vehicle networks and within ECUs. This paper focuses on the last defense barrier, for which related research and industry propose the installation of IDS and intrusion prevention systems (IPS), e.g. for in-vehicle CAN networks [1,7–9]. The presented IDS concept for CAN combines the efficiency of a specification-based approach with the advanced detection of irregula
Data Loading...
