Research Article
Anomaly Detection for Connected Autonomous Vehicles Using LSTM and Gaussian Naïve Bayes
@INPROCEEDINGS{10.1007/978-3-031-34851-8_3, author={Pegah Mansourian and Ning Zhang and Arunita Jaekel and Mina Zamanirafe and Marc Kneppers}, title={Anomaly Detection for Connected Autonomous Vehicles Using LSTM and Gaussian Na\~{n}ve Bayes}, proceedings={Wireless and Satellite Systems. 13th EAI International Conference, WiSATS 2022, Virtual Event, Singapore, March 12-13, 2023, Proceedings}, proceedings_a={WISATS}, year={2023}, month={6}, keywords={In-vehicle security CAN Anomaly detection IDS LSTM}, doi={10.1007/978-3-031-34851-8_3} }- Pegah Mansourian
Ning Zhang
Arunita Jaekel
Mina Zamanirafe
Marc Kneppers
Year: 2023
Anomaly Detection for Connected Autonomous Vehicles Using LSTM and Gaussian Naïve Bayes
WISATS
Springer
DOI: 10.1007/978-3-031-34851-8_3
Abstract
In the foreseen future, connected autonomous vehicles (CAVs) are expected to improve driving safety and experience considerably; however, cybersecurity remains a critical issue. CAN protocol, the de-facto standard for in-vehicle networks, provides no security mechanism, which makes it one of the most attack-prone parts. The lack of security mechanisms in CAN messages allows intruders to conduct devastating attacks, putting drivers’ and passengers’ lives at risk. An Intrusion Detection System (IDS) can monitor CAN network activities and detect suspicious behaviors resulting from an attack to help safeguard CAVs. The destructive behavior of an intruder is reflected as point and group anomalies in the sequence of CAN messages. Our study proposes an LSTM-based IDS for the CAN bus by exploiting the temporal correlations of the messages on the bus to detect anomalies. Specifically, it is a one-class classifier trained with attack-free data to predict the upcoming value of CAN messages. Then a Gaussian Naïve Bayes classifier is used to classify messages as normal and attack according to the resulting prediction errors. The proposed IDS is evaluated in terms of detection performance and compared with state-of-the-art one-class classifiers, including OCSVM, Isolation Forest, and Autoencoder, using two real-world datasets (Car Hacking Dataset and Survival Analysis Dataset). The proposed method outperforms baselines and achieves detection accuracy and F-score by nearly 100%.
