Comparative evaluation of anomaly-based controller area network IDS

The vulnerability of in-vehicle networks, particularly those based on the Controller Area Network (CAN) protocol, has prompted the development of numerous techniques for intrusion detection on the CAN bus. However, these CAN IDS are often evaluated in disparate experimental settings, with different...

全面介绍

Saved in:
书目详细资料
Main Authors: Sharmin, Shaila, Mansor, Hafizah, Abdul Kadir, Andi Fitriah, Abdul Aziz, Normaziah
格式: Conference or Workshop Item
语言:English
English
出版: Association for Computing Machinery 2023
主题:
在线阅读:http://irep.iium.edu.my/105306/1/105306_Comparative%20evaluation%20of%20anomaly-based.pdf
http://irep.iium.edu.my/105306/7/105306_Comparative%20evaluation%20of%20anomaly-based_SCOPUS.pdf
http://irep.iium.edu.my/105306/
https://dl.acm.org/doi/10.1145/3587828.3587861
标签: 添加标签
没有标签, 成为第一个标记此记录!
实物特征
总结:The vulnerability of in-vehicle networks, particularly those based on the Controller Area Network (CAN) protocol, has prompted the development of numerous techniques for intrusion detection on the CAN bus. However, these CAN IDS are often evaluated in disparate experimental settings, with different datasets and evaluation metrics, which hinder direct comparison. This has given rise to efforts at benchmarking and comparative evaluation of CAN IDS under similar experimental conditions to provide an understanding of the relative performance of these CAN IDS. This work contributes to these efforts by reporting results of the comparative evaluation of four statistical and two machine learning-based CAN intrusion detection algorithm, against the Real ORNL Automotive Dynamometer (ROAD) CAN intrusion dataset. The ROAD dataset differs from datasets used in previous work in that it includes the stealthiest possible version of targeted ID fabrication attacks which are more difficult to detect. It also consists of masquerade attacks, which have not been commonly used in comparative evaluation studies. Furthermore, in addition to metrics such as accuracy, precision, recall, and F1-score, we report balanced accuracy, informedness, markedness, and Matthews correlation coefficient, which place equal important on positive and negative classes and are better measures of detection capability, especially for imbalanced datasets. We also report training and testing times for each CAN IDS as an indicator of real-time intrusion detection performance. Results of experiments were found to be generally concordant with previous work, in terms of accuracy, precision, recall, and F1-score. Entropy and frequency-based CAN IDS were found to be relatively better at detecting attacks, particularly fabrication attacks; while other algorithms did not perform well, as indicated by low MCC scores.