AIセキュリティポータル K Program
Detecting Masquerade Attacks in Controller Area Networks Using Graph Machine Learning
Share
Abstract
Modern vehicles rely on a myriad of electronic control units (ECUs) interconnected via controller area networks (CANs) for critical operations. Despite their ubiquitous use and reliability, CANs are susceptible to sophisticated cyberattacks, particularly masquerade attacks, which inject false data that mimic legitimate messages at the expected frequency. These attacks pose severe risks such as unintended acceleration, brake deactivation, and rogue steering. Traditional intrusion detection systems (IDS) often struggle to detect these subtle intrusions due to their seamless integration into normal traffic. This paper introduces a novel framework for detecting masquerade attacks in the CAN bus using graph machine learning (ML). We hypothesize that the integration of shallow graph embeddings with time series features derived from CAN frames enhances the detection of masquerade attacks. We show that by representing CAN bus frames as message sequence graphs (MSGs) and enriching each node with contextual statistical attributes from time series, we can enhance detection capabilities across various attack patterns compared to using only graph-based features. Our method ensures a comprehensive and dynamic analysis of CAN frame interactions, improving robustness and efficiency. Extensive experiments on the ROAD dataset validate the effectiveness of our approach, demonstrating statistically significant improvements in the detection rates of masquerade attacks compared to a baseline that uses only graph-based features, as confirmed by Mann-Whitney U and Kolmogorov-Smirnov tests (p < 0.05).
Coids: A clock offset based intrusion detection system for controller area networks
S. Halder, M. Conti, S. K. Das
Published: 2020
An efficient authentication scheme for intra-vehicular controller area network
B. Palaniswamy, S. A. Camtepe, E. Foo, J. Pieprzyk
Published: 2020
Cantropy: Time series feature extraction-based intrusion detection systems for controller area networks
M. H. Shahriar, W. Lou, Y. T. Hou
Published: 2023
CANTransfer: Transfer learning based intrusion detection on a controller area network using convolutional LSTM network
S. Tariq, S. Lee, S. S. Woo
Published: 2020
Cansec: A practical in-vehicle controller area network security evaluation tool
H. Zhang, X. Meng, X. Zhang, Z. Liu
Published: 2020
Tce-ids: Time interval conditional entropy-based intrusion detection system for automotive controller area networks
Z. Yu, Y. Liu, G. Xie, R. Li, S. Liu, L. T. Yang
Published: 2022
Remote exploitation of an unaltered passenger vehicle
C. Miller, C. Valasek
Published: 2015
Comparative evaluation of anomaly-based controller area network ids
S. Sharmin, H. Mansor, A. F. A. Kadir, N. A. Aziz
Published: 2023
Intrusion detection system for controller area network
V. Tanksale
Published: 2024
Cy-phy ads: Cyber physical anomaly detection framework for ev charging systems
H. S. Mavikumbure, V. Cobilean, C. S. Wickramasinghe, B. J. Varghese, B. Carlson, C. Rieger, M. Manic
Published: 2024
A review of anomaly detection strategies to detect threats to cyber-physical systems
Nicholas Jeffrey, Qing Tan, José R Villar
Published: 2023
Condition monitoring and anomaly detection in cyber-physical systems
W. Marfo, D. K. Tosh, S. V. Moore
Published: 2022
Intrusion device detection in fieldbus networks based on channel-state group fingerprint
X. Wang, Y. Liu, K. Jiao, P. Liu, X. Luo, T. Liu
Published: 2024
Robust anomaly-based intrusion detection system for in-vehicle network by graph neural network framework
J. Xiao, L. Yang, F. Zhong, H. Chen, X. Li
Published: 2023
A comprehensive guide to can ids data and introduction of the road dataset
M. E. Verma, R. A. Bridges, M. D. Iannacone, S. C. Hollifield, P. Moriano, S. C. Hespeler
Published: 2024
Car hacking identification through fuzzy logic algorithms
F. Martinelli, F. Mercaldo, V. Nardone, A. Santone
Published: 2017
Vadgan: An unsupervised gan framework for enhanced anomaly detection in connected and autonomous vehicles
S. Devika, R. R. Shrivastava, P. Narang, T. Alladi, F. R. Yu
Published: 2024
Anomaly detection for in-vehicle network using cnn-lstm with attention mechanism
H. Sun, M. Chen, J. Weng, Z. Liu, G. Geng
Published: 2021
Retracted: An evolutionary deep learning anomaly detection framework for in-vehicle networks-can bus
Y. Lin, C. Chen, F. Xiao, O. Avatefipour, K. Alsubhi, A. Yunianta
Published: 2020
A survey of attacks on controller area networks and corresponding countermeasures
H. J. Jo, W. Choi
Published: 2021
Detection of message injection attacks onto the can bus using similarities of successive messages-sequence graphs
M. Jedh, L. B. Othmane, N. Ahmed, B. Bhargava
Published: 2021
Application-layer anomaly detection leveraging time-series physical semantics in can-fd vehicle networks
R. Zhao, C. Luo, F. Gao, Z. Gao, L. Li, D. Zhang, W. Yang
Published: 2024
Federated graph neural network for fast anomaly detection in controller area networks
H. Zhang, K. Zeng, S. Lin
Published: 2023
Understanding and Using the Controller Area Network Communication Protocol: Theory and Practice
M. D. Natale, H. Zeng, P. Giusto, A. Ghosal
Published: 2012
Human behavior characterization for driving style recognition in vehicle system
F. Martinelli, F. Mercaldo, A. Orlando, V. Nardone, A. Santone, A. K. Sangaiah
Published: 2020
Librecan: Automated can message translator
M. D. Pese, T. Stacer, C. A. Campos, E. Newberry, D. Chen, K. G. Shin
Published: 2019
Security threats to automotive can networks – practical examples and selected short-term countermeasures
T. Hoppe, S. Kiltz, J. Dittmann
Published: 2008
Crysys dataset of can traffic logs containing fabrication and masquerade attacks
A. Gazdag, R. Ferenc, L. Buttyan
Published: 2023
Can-mirgu: A comprehensive can bus attack dataset from moving vehicles for intrusion detection system evaluation
S. Rajapaksha, G. Madzudzo, H. Kalutarage, A. Petrovski, M. O. Al-Kadri
Published: 2024
Detecting CAN Masquerade Attacks with Signal Clustering Similarity
P. Moriano, R. A. Bridges, M. D. Iannacone
Published: 2022
Graph embedding techniques, applications, and performance: A survey
P. Goyal, E. Ferrara
Published: 2018
Structural deep network embedding
D. Wang, P. Cui, W. Zhu
Published: 2016
Random Walks on Graphs
W. Husen
Published: 2018
Random Walks on Graphs
D. A. Spielman
Published: 2018
Machine learning on graphs: A model and comprehensive taxonomy
I. Chami, S. Abu-El-Haija, B. Perozzi, C. Re, K. Murphy
Published: 2022
Trends in Biomathematics: Chaos and Control in Epidemics, Ecosystems, and Cells
R. P. Mondaini
Published: 2021
node2vec: Scalable feature learning for networks
A. Grover, J. Leskovec
Published: 2016
Systematic comparison of graph embedding methods in practical tasks
Y. J. Zhang, K. C. Yang, F. Radicchi
Published: 2021
Graph-based intrusion detection system for controller area networks
R. Islam, R. U. D. Refat, S. M. Yerram, H. Malik
Published: 2020
Ggnb: Graph-based gaussian naive bayes intrusion detection system for can bus
R. Islam, M. K. Devnath, M. D. Samad, S. M. J. Al Kadry
Published: 2022
A graph-based strategy for intrusion detection in connected vehicles
M. Sreelekshmi, S. Aji
Published: 2022
A lightweight intrusion detection system for can protocol using neighborhood similarity
R. U. D. Refat, A. A. Elkhail, H. Malik
Published: 2022
In-vehicle network intrusion detection using deep convolutional neural network
H. M. Song, J. Woo, H. K. Kim
Published: 2020
On the performance of detecting injection of fabricated messages into the can bus
L. B. Othmane, L. Dhulipala, M. Abdelkhalek, N. Multari, M. Govindarasu
Published: 2022
G-idcs: Graph-based intrusion detection and classification system for can protocol
S. B. Park, H. J. Jo, D. H. Lee
Published: 2023
Gb-ids: An intrusion detection system for can bus based on graph analysis
Y. Meng, J. Li, F. Liu, S. Li, H. Hu, H. Zhu
Published: 2023
OTIDS: A novel intrusion detection system for in-vehicle network by using remote frame
H. Lee, S. H. Jeong, H. K. Kim
Published: 2017
Canshield: Deep-learning-based intrusion detection framework for controller area networks at the signal level
M. H. Shahriar, Y. Xiao, P. Moriano, W. Lou, Y. T. Hou
Published: 2023
Btmonitor: Bit-time-based intrusion detection and attacker identification in controller area network
J. Zhou, P. Joshi, H. Zeng, R. Li
Published: 2019
Shape of the cloak: Formal analysis of clock skew-based intrusion detection system in controller area networks
X. Ying, S. U. Sagong, A. Clark, L. Bushnell, R. Poovendran
Published: 2019
CANet: An unsupervised intrusion detection system for high dimensional CAN bus data
M. Hanselmann, T. Strauss, K. Dormann, H. Ulmer
Published: 2020
Symmetry degree measurement and its applications to anomaly detection
T. Qin, Z. Liu, P. Wang, S. Li, X. Guan, L. Gao
Published: 2020
Graph-based machine learning improves just-in-time defect prediction
J. Bryan, P. Moriano
Published: 2023
Can-d: A modular four-step pipeline for comprehensively decoding controller area network data
M. E. Verma, R. A. Bridges, J. J. Sosnowski, S. C. Hollifield, M. D. Iannacone
Published: 2021
A survey on controller area network reverse engineering
A. Buscemi, I. Turcanu, G. Castignani, A. Panchenko, T. Engel, K. G. Shin
Published: 2023
Knowledge graph embedding: A survey from the perspective of representation spaces
J. Cao, J. Fang, Z. Meng, S. Liang
Published: 2024
A survey on graph representation learning methods
S. Khoshraftar, A. An
Published: 2024
Knowledge graph embedding methods for entity alignment: experimental review
N. Fanourakis, V. Efthymiou, D. Kotzinos, V. Christophides
Published: 2023
Principled approach to the selection of the embedding dimension of networks
W. Gu, A. Tandon, Y.-Y. Ahn, F. Radicchi
Published: 2021
A survey on graph neural networks for intrusion detection systems: Methods, trends and challenges
M. Zhong, M. Lin, C. Zhang, Z. Xu
Published: 2024
Random forests
L. Breiman
Published: 2001
Xgboost: A scalable tree boosting system
T. Chen, C. Guestrin
Published: 2016
Smote: synthetic minority over-sampling technique
N. V. Chawla, K. W. Bowyer, L. O. Hall, W. P. Kegelmeyer
Published: 2002
An introduction to roc analysis
T. Fawcett
Published: 2006
On a test of whether one of two random variables is stochastically larger than the other
H. B. Mann, D. R. Whitney
Published: 1947
Kolmogorov–smirnov test: Overview
V. W. Berger, Y. Zhou
Published: 2014
Share