IEEE Consumer Electronics Magazine - January/February 2023 - 104

Security, Trust and Privacy Solutions for Intelligent Internet of Vehicular Things
indicates that the proposed method is robust and generalizable across detecting various
attacks in a CAN bus and most importantly, the method can be used in real time to
effectively monitor the CAN network traffic to proactively alert possible attacks.
& DEVELOPMENTS IN THE automobile industry are
far-reaching due to the advancements in vehicles
concerning automation, comfort, and technology.
Modern vehicles use electronic control units
(ECUs) to communicate with each other. ECUs are
embedded in the vehicle body to control smart
functions that help the vehicles to be more intelligent
and autonomous. The controller area network
(CAN) is a serial protocol used to control the
communications between different ECUs.1 Sharing
of information increases as the autonomous functions
with the vehicles are implemented. This
demands the use of an in-vehicle CAN bus as it
provides seamless data transfer and control.
Despite the advantages of CAN protocol,
vehicles are exposed to threats due to the high
amount of data sharing between ECUs.2 These
threats can be spoofing attacks that can break the
CAN bus to take control of the ECUs in the vehicle.
This weakness in the security of the CANbus leads
to the threat of attack or control of the vehicle by
just injecting messages.3 This way, an attack can
be implemented using any vulnerable features in
the vehicle such as gear change, airbag, braking,
etc. These attacks in a CAN protocol are possible
as the CAN does not have any authentication or
encryption and so detecting these attacks can
help in avoiding them. There are various CAN
attacks that are introduced in the literature such
as denial of service (DoS), fuzzing, and targeted ID
attack.4 Collectively these attacks are known as
fabrication attacks, which suffer from conflicts in
the messages received by ECUs as they will be
receiving both legitimate and arbitrary messages.
Detecting these attacks prevents the ECUs from
malfunctioning and also helps in taking appropriate
actions against the conflicting information.
In recent days, CAN intrusion detection systems
(IDSs) are employed to detect and identify
CAN attacks. An extensive overview of the existing
methods for CAN intrusion detection is discussed
and summarized in the works of Rehman
et al.1 and Seo et al.3 Rule-based methods and
statistical methods are employed for CAN intrusion
detection. Both methods are effective in
detecting the known attacks. Besides, both
methods require extensive domain knowledge to
generate rules and configure CAN IDS. To detect
new or variants of existing attacks on a CAN,
machine learning-based methods have been
employed to classify the normal messages from
attack messages.5 Significant improvement with
deep learning methods is leveraged for classification.1
The use of the dense neural network
(DNN) and long-short term memory (LSTM) cells
have performed well in anomaly detection and
intrusion detection in the CAN messages.2
Although the existing methods for CAN intrusion
detectionhave achievedbetter performances,
the main drawback is that all of these methods
require labeled datasets, and the manual annotation
of data is time-consuming and difficult. Thus,
this research employs unsupervised learning,
which does not require any labels on the data. The
proposed unsupervised method is a two-stage
approach using deep learning and a probabilistic
model. The first stage employs deep learning, i.e.,
autoencoder, which extracts optimal features to
differentiate between normal data and attacks in
CAN; and the second stage employs a probabilistic
model, i.e., GMM to cluster the optimal features of
the first stage into normal and attacks. The major
contributions of the proposed work are as follows.
1) Autoencoder approach is employed for learning
optimal features to differentiate between
normal data and attacks in a CAN bus.
2) GMM is employed to cluster the CAN network
packet data into normal and attacks.
3) Detailed investigation and analysis of the proposedmethod
are shown on a CAN IDS dataset.
4) To develop a robust CAN IDS system and
achieve generalization, the performance analysis
is shown for two computer network intrusion
datasets and a wireless sensor network
intrusion dataset as well.
5) The existing unsupervised approach, i.e.,
improved deep embedded clustering (IDEC)6
is evaluated on a CAN IDS dataset and compared
with the proposed approach.
104
IEEE Consumer Electronics Magazine
IEEE Consumer Electronics Magazine - January/February 2023

Table of Contents for the Digital Edition of IEEE Consumer Electronics Magazine - January/February 2023
