Intrusion Detection in the CAN bus using Long Short-Term Memory Networks

Araya Kibrom Desta ( 1751203 )


Nowadays, vehicles are equipped with multiple Electronic Control Units (ECUs) each of which communicates with one another using a specification called Controller Area Network (CAN). CAN provide its own share of benefits in modernizing automobiles, but it also brought along a security issue to the automotive industry. CAN bus does not have any mechanism for encrypting or authenticating CAN payloads. As a countermeasure against these drawbacks, we have experimented on identifying intrusions in the CAN bus using Long Short-Term Memory Networks (LSTM). LSTM networks are trained to predict forthcoming payloads and related attributes by looking at information that has already appeared in the CAN bus at some instant in time. The predicted values are compared with actual values, that are either sent by an intruder or the benign ones. Depending on how close the prediction is with the actual payload, we managed to effectively identify anomalies in an acceptable accuracy rate, up to 98\%. Furthermore, we also experimented on an intrusion detection system (IDS) based on the sequence of arbitration IDs of the packets. The trained network learns about the sequence of packet IDs to predict a forth coming packet ID. This IDS is similar with the previous one except an anomaly signal is generated by comparing only the predicted ID and actual ID. We have tested our methods with a variety of attacks on the CAN bus and demonstrated how effective our detection methods are.