.png){kind=icon}
返回
Detecting Masquerade Attacks in Controller Area Networks Using Graph Machine Learning
.png){kind=icon}
PRE
AI
DOI：10.1109/TIFS.2025.3636019.png)
.png){kind=icon}
原文求助.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
Modern vehicles rely on a myriad of electronic control units (ECUs) interconnected via controller area networks (CANs) for critical operations. Despite their ubiquitous use and reliability, CANs are susceptible to sophisticated cyberattacks, particularly masquerade attacks, which inject false data that mimic legitimate messages at the expected frequency. These attacks pose severe risks such as unintended acceleration, brake deactivation, and rogue steering. Traditional intrusion detection systems (IDS) often struggle to detect these subtle intrusions due to their seamless integration into normal traffic. This paper introduces a novel framework for detecting masquerade attacks in the CAN bus using graph machine learning (ML). We hypothesize that the integration of shallow graph embeddings with time series features derived from CAN frames enhances the detection of masquerade attacks. We show that by representing CAN bus frames as message sequence graphs (MSGs) and enriching each node with contextual statistical attributes from time series, we can enhance detection capabilities across various attack patterns compared to using graph-based features only. Our method ensures a comprehensive and dynamic analysis of CAN frame interactions, improving robustness and efficiency. Extensive experiments on the ROAD dataset validate the effectiveness of our approach, demonstrating statistically significant improvements in the detection rates of masquerade attacks compared to a baseline that uses graph-based features only as confirmed by Mann-Whitney U and Kolmogorov-Smirnov tests (p < 0.05).
Keyword:
Accuracy
Controller area networks
Time series analysis
Roads
Training
Protocols
Fabrication
Computer crime
Suspensions (mechanical systems)
Payloads
intrusion detection systems
graph ML
masquerade attacks
期刊
IF:
8
论文数:
5.3K
被引数:
2.3W
机构
引用论文
In-vehicle network intrusion detection using deep convolutional neural network基于深度卷积神经网络的车载网络入侵检测
PREAI
分享收藏Rajapaksha, S.; Madzudzo, G.; Kalutarage, H.; Petrovski, A.; Al-Kadri, M.O. CAN-MIRGU: A Comprehensive CAN Bus Attack Dataset from Moving Vehicles for Intrusion Detection System Evaluation. In Proceedings of the Symposium on Vehicle Security and Privacy (VehicleSec), NDSS, San Diego, CA, USA, 26 February 2024. [Google Scholar] [CrossRef]Rajapaksha, S.; Madzudzo, G.; Kalutarage, H.; Petrovski, A.; Al-Kadri, M.O. CAN-MIRGU：用于入侵检测系统评估的移动车辆CAN总线攻击综合数据集。载于：车辆安全与隐私研讨会（VehicleSec）会议录，NDSS, 加利福尼亚州圣迭戈市，美国，2024年2月26日。[Google Scholar] [CrossRef].png)
IF0
PREAI
分享收藏分享收藏分享收藏
查看更多内容