Adaptive Autoencoder-Based Intrusion Detection System with Single Threshold for CAN Networks

Area of Science:

• Cybersecurity
• Automotive Engineering
• Network Security

Background:

• Controller Area Network (CAN) protocol is crucial for in-vehicle communication but lacks inherent security, making it vulnerable to attacks.
• Existing intrusion detection systems (IDS) for CAN networks are often complex and not optimized for real-time, on-device implementation.
• Need for robust and efficient security solutions to protect modern vehicles from cyber threats.

Purpose of the Study:

• To propose a novel, lightweight, unsupervised IDS for CAN networks suitable for real-time, on-device deployment.
• To develop an autoencoder-based model trained on normal CAN data for effective attack detection.
• To optimize the system for hardware implementation on Field-Programmable Gate Arrays (FPGAs).

Main Methods:

• An autoencoder model was trained exclusively on normal CAN traffic data.
• Gaussian kernel density estimation and error rate analysis were used to determine the optimal detection threshold and frame count.
• The model was validated on an FPGA using unseen attack data, employing a single detection threshold for all attack types.

Main Results:

• The proposed IDS achieved high performance metrics: 99.2% average accuracy, 99.2% precision, 99.1% recall, and 99.2% F1-score.
• The system demonstrated effective detection of four different types of attacks not encountered during training.
• Significant reduction in hardware resource utilization (LUTs, flip-flops) and power consumption compared to existing FPGA-based IDS.

Conclusions:

• The developed lightweight unsupervised IDS offers a highly accurate and efficient solution for securing CAN networks in real-time.
• The FPGA implementation provides a practical and resource-efficient approach for on-device intrusion detection in vehicles.
• The system's ability to detect diverse attacks with a single model and threshold highlights its robustness and adaptability.