A Multi-Layer Intrusion Detection System for SOME/IP-Based In-Vehicle Network

Area of Science:

• Cybersecurity
• Automotive Engineering
• Network Protocols

Background:

• Automotive Ethernet is replacing Controller Area Network (CAN) as the primary in-vehicle network (IVN).
• Scalable service-Oriented MiddlewarE over IP (SOME/IP) is crucial for service-based communication in modern vehicles.
• Vulnerabilities in SOME/IP and increased external interfaces pose significant cybersecurity risks to IVNs.

Purpose of the Study:

• To propose a novel multi-layer Intrusion Detection System (IDS) architecture for SOME/IP-based IVNs.
• To develop a method for establishing a SOME/IP dataset for IDS performance evaluation.
• To assess the effectiveness and efficiency of the proposed IDS in detecting intrusions.

Main Methods:

• A hybrid IDS architecture combining rule-based and Artificial Intelligence (AI)-based modules.
• Rule-based detection focusing on SOME/IP headers, service discovery messages, message intervals, and communication flows.
• AI-based detection targeting the payload of SOME/IP messages.
• Creation of a dedicated SOME/IP dataset for empirical validation.

Main Results:

• Rule-based detection achieved 100% accuracy, while AI-based detection reached 99.7761% accuracy.
• Average packet detection times of 0.3958 ms with GPU acceleration and 0.6669 ms with CPU.
• Demonstrated feasibility for deployment in distributed or centralized configurations for critical Advanced Driving Assistance System (ADAS) traffic.

Conclusions:

• The proposed multi-layer IDS effectively detects intrusions in SOME/IP IVNs with high accuracy and low latency.
• The system is suitable for real-time vehicle-level deployment, enhancing the security of connected vehicles.
• The developed SOME/IP dataset aids future research in automotive network security.