Abstract:

Detecting abnormal data generated from cyberattacks has emerged as a crucial approach for identifying security threats within in-vehicle networks. The transmission of information through in-vehicle networks needs to follow specific data formats and communication protocols regulations. Typically, statistical algorithms are employed to learn these variation rules and facilitate the identification of abnormal data. However, the effectiveness of anomaly detection outcomes often falls short when confronted with highly deceptive in-vehicle network attacks. In this study, seven representative classification algorithms are selected to detect common in-vehicle network attacks, and a comparative analysis is employed to identify the most suitable and favorable detection method. In consideration of the communication protocol characteristics of in-vehicle networks, an optimal convolutional neural network (CNN) detection algorithm is proposed that uses data field characteristics and classifier selection, and its comprehensive performance is tested. In addition, the concept of Hamming distance between two adjacent packets within the in-vehicle network is introduced, enabling the proposal of an enhanced CNN algorithm that achieves robust detection of challenging-to-identify abnormal data. This paper also presents the proposed CNN classification algorithm that effectively addresses the issue of high false negative rate (FNR) in abnormal data detection based on the timestamp feature of data packets. The experimental results validate the efficacy of the proposed abnormal data detection algorithm, highlighting its strong detection performance and its potential to provide an effective solution for safeguarding the security of in-vehicle network information.