BEPCD: an ensemble learning-based intrusion detection framework for in-vehicle CAN bus.

Area of Science:

• Cybersecurity
• Automotive Engineering
• Machine Learning

Background:

• Intelligent vehicles and the Internet of Vehicles (IoV) are rapidly developing, increasing concerns about vehicle security.
• Controller Area Network (CAN) bus intrusions threaten critical vehicle systems, but current detection methods struggle with feature extraction and diverse attack types.
• Electronic Control Units (ECUs) manage vehicle functions via the CAN bus, making it a target for cyberattacks.

Purpose of the Study:

• To propose a novel intrusion detection framework, Basic Ensemble and Pioneer Class Decision (BEPCD), for in-vehicle CAN bus systems.
• To enhance the detection of both conventional and emerging cyberattack patterns in IoV environments.
• To address limitations in existing methods regarding feature extraction and the variety of detectable attacks.

Main Methods:

• Developed a 15-dimensional feature model to hierarchically characterize CAN bus messages.
• Implemented multi-model ensemble learning with a Pioneer class selector and confidence-driven voting for precise attack classification.
• Analyzed feature importance across four machine learning algorithms to understand data contributions.

Main Results:

• The BEPCD framework effectively detects intrusions in vehicle CAN bus systems using public datasets.
• Achieved an overall F1-score improvement of 1% to 5% compared to existing intrusion detection frameworks.
• Demonstrated a significant performance enhancement of approximately 77.5% in detecting replay attacks.

Conclusions:

• The BEPCD framework offers a robust solution for detecting diverse cyber threats in IoV systems.
• BEPCD enhances vehicle security by improving the accuracy and scope of intrusion detection on CAN buses.
• The proposed method represents a significant advancement in securing connected vehicles against sophisticated cyberattacks.