A Kohonen SOM Architecture for Intrusion Detection on In-Vehicle Communication Networks
The diffusion of connected devices in modern vehicles involves a lack in security of the in-vehicle communication networks such as the controller area network (CAN) bus. The CAN bus protocol does not provide security systems to counter cyber and physical attacks. Thus, an intrusion-detection system...
| Main Authors: | , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
MDPI AG
2020-07-01
|
| Series: | Applied Sciences |
| Subjects: | |
| Online Access: | https://www.mdpi.com/2076-3417/10/15/5062 |
| _version_ | 1797561564715286528 |
|---|---|
| author | Vita Santa Barletta Danilo Caivano Antonella Nannavecchia Michele Scalera |
| author_facet | Vita Santa Barletta Danilo Caivano Antonella Nannavecchia Michele Scalera |
| author_sort | Vita Santa Barletta |
| collection | DOAJ |
| description | The diffusion of connected devices in modern vehicles involves a lack in security of the in-vehicle communication networks such as the controller area network (CAN) bus. The CAN bus protocol does not provide security systems to counter cyber and physical attacks. Thus, an intrusion-detection system to identify attacks and anomalies on the CAN bus is desirable. In the present work, we propose a distance-based intrusion-detection network aimed at identifying attack messages injected on a CAN bus using a Kohonen self-organizing map (SOM) network. It is a power classifier that can be trained both as supervised and unsupervised learning. SOM found broad application in security issues, but was never performed on in-vehicle communication networks. We performed two approaches, first using a supervised X–Y fused Kohonen network (XYF) and then combining the XYF network with a K-means clustering algorithm (XYF–K) in order to improve the efficiency of the network. The models were tested on an open source dataset concerning data messages sent on a CAN bus 2.0B and containing large traffic volume with a low number of features and more than 2000 different attack types, sent totally at random. Despite the complex structure of the CAN bus dataset, the proposed architectures showed a high performance in the accuracy of the detection of attack messages. |
| first_indexed | 2024-03-10T18:15:43Z |
| format | Article |
| id | doaj.art-326cad8c721e4166a69397fc7fd2e75a |
| institution | Directory Open Access Journal |
| issn | 2076-3417 |
| language | English |
| last_indexed | 2024-03-10T18:15:43Z |
| publishDate | 2020-07-01 |
| publisher | MDPI AG |
| record_format | Article |
| series | Applied Sciences |
| spelling | doaj.art-326cad8c721e4166a69397fc7fd2e75a2023-11-20T07:40:31ZengMDPI AGApplied Sciences2076-34172020-07-011015506210.3390/app10155062A Kohonen SOM Architecture for Intrusion Detection on In-Vehicle Communication NetworksVita Santa Barletta0Danilo Caivano1Antonella Nannavecchia2Michele Scalera3Department of Informatics, University of Bari Aldo Moro, Via E. Orabona 4, 70125 Bari, ItalyDepartment of Informatics, University of Bari Aldo Moro, Via E. Orabona 4, 70125 Bari, ItalyDepartment of Economics and Management, University LUM Jean Monnet, SS 100 km 18, 70010 Casamassima (BA), ItalyDepartment of Informatics, University of Bari Aldo Moro, Via E. Orabona 4, 70125 Bari, ItalyThe diffusion of connected devices in modern vehicles involves a lack in security of the in-vehicle communication networks such as the controller area network (CAN) bus. The CAN bus protocol does not provide security systems to counter cyber and physical attacks. Thus, an intrusion-detection system to identify attacks and anomalies on the CAN bus is desirable. In the present work, we propose a distance-based intrusion-detection network aimed at identifying attack messages injected on a CAN bus using a Kohonen self-organizing map (SOM) network. It is a power classifier that can be trained both as supervised and unsupervised learning. SOM found broad application in security issues, but was never performed on in-vehicle communication networks. We performed two approaches, first using a supervised X–Y fused Kohonen network (XYF) and then combining the XYF network with a K-means clustering algorithm (XYF–K) in order to improve the efficiency of the network. The models were tested on an open source dataset concerning data messages sent on a CAN bus 2.0B and containing large traffic volume with a low number of features and more than 2000 different attack types, sent totally at random. Despite the complex structure of the CAN bus dataset, the proposed architectures showed a high performance in the accuracy of the detection of attack messages.https://www.mdpi.com/2076-3417/10/15/5062intrusion detection systemsupervised learningKohonen self-organizing mapsCAN bus |
| spellingShingle | Vita Santa Barletta Danilo Caivano Antonella Nannavecchia Michele Scalera A Kohonen SOM Architecture for Intrusion Detection on In-Vehicle Communication Networks Applied Sciences intrusion detection system supervised learning Kohonen self-organizing maps CAN bus |
| title | A Kohonen SOM Architecture for Intrusion Detection on In-Vehicle Communication Networks |
| title_full | A Kohonen SOM Architecture for Intrusion Detection on In-Vehicle Communication Networks |
| title_fullStr | A Kohonen SOM Architecture for Intrusion Detection on In-Vehicle Communication Networks |
| title_full_unstemmed | A Kohonen SOM Architecture for Intrusion Detection on In-Vehicle Communication Networks |
| title_short | A Kohonen SOM Architecture for Intrusion Detection on In-Vehicle Communication Networks |
| title_sort | kohonen som architecture for intrusion detection on in vehicle communication networks |
| topic | intrusion detection system supervised learning Kohonen self-organizing maps CAN bus |
| url | https://www.mdpi.com/2076-3417/10/15/5062 |
| work_keys_str_mv | AT vitasantabarletta akohonensomarchitectureforintrusiondetectiononinvehiclecommunicationnetworks AT danilocaivano akohonensomarchitectureforintrusiondetectiononinvehiclecommunicationnetworks AT antonellanannavecchia akohonensomarchitectureforintrusiondetectiononinvehiclecommunicationnetworks AT michelescalera akohonensomarchitectureforintrusiondetectiononinvehiclecommunicationnetworks AT vitasantabarletta kohonensomarchitectureforintrusiondetectiononinvehiclecommunicationnetworks AT danilocaivano kohonensomarchitectureforintrusiondetectiononinvehiclecommunicationnetworks AT antonellanannavecchia kohonensomarchitectureforintrusiondetectiononinvehiclecommunicationnetworks AT michelescalera kohonensomarchitectureforintrusiondetectiononinvehiclecommunicationnetworks |