A Novel Architecture for an Intrusion Detection System Utilizing Cross-Check Filters for In-Vehicle Networks

Area of Science:

• Cybersecurity
• Automotive Engineering
• Network Security

Background:

• Controller Area Network (CAN) bus systems are essential for vehicular communication but are susceptible to cyber-threats.
• Existing machine learning (ML)-based intrusion detection systems (IDS) for CAN bus have limitations in detection performance.
• Effective detection of malicious messages is crucial for ensuring vehicle cybersecurity.

Purpose of the Study:

• To propose a novel IDS architecture for enhancing the cybersecurity of CAN bus systems.
• To improve the detection performance of ML-based IDS by incorporating rule-based filters.
• To effectively distinguish between legitimate and malicious CAN messages, specifically targeting DoS, spoofing, and fuzzy attacks.

Main Methods:

• Developed a hybrid IDS architecture combining traditional ML models with specially designed rule-based filters.
• Filters scrutinize CAN message ID and payload data to identify specific attack characteristics.
• Evaluated the architecture's effectiveness against Denial of Service (DoS), spoofing, and fuzzy attacks.

Main Results:

• The proposed architecture significantly improved detection performance across all tested ML models.
• All ML-based IDS integrated with the new architecture achieved over 99% accuracy in detecting all attack types.
• The rule-based filters effectively captured unique features of DoS, spoofing, and fuzzy attacks.

Conclusions:

• The novel IDS architecture offers a robust and effective solution for enhancing CAN bus cybersecurity.
• The hybrid approach overcomes the suboptimal detection performance of purely ML-based IDS.
• The system demonstrates high accuracy and effectiveness in identifying various cyber threats in vehicles.