Development of a Security Experimental Platform and Simulated Attack Detection for In-Vehicle Networks

Abstract

With the rapid advancement of automotive technology, the demand for diverse connectivity in vehicles has increased significantly, leading to security and privacy concerns such as network intrusions. In-Vehicle Networks (IVN) currently employ the Controller Area Network (CAN) bus system to facilitate communication between various Electronic Control Units (ECUs). However, ECUs may have security vulnerabilities, and the attack methods on CAN systems differ from traditional internet communication. Conventional Intrusion Detection Systems (IDS) may struggle to identify and defend against threats in in-vehicle networks effectively. This research focuses on the development of intrusion detection models based on deep learning. The study uses the 2021 dataset from the Korean Hacking and Countermeasure Research Lab (HCRL) for in-vehicle network attacks, including eavesdropping (Sniffer), Denial of Service (DoS), Fuzzy attacks, Spoofing Gear, RPM, and Temperature attacks. To conduct in-vehicle network security experiments, the study addresses the lack of a practical environment for generating attack message and conducting intrusion detection analysis and verification in the domestic context. Thus, the research utilizes physical in-vehicle network hardware to establish a CAN security experimental platform, which generates six real attack scenarios. These scenarios are then used for attack behavior feature learning and recognition using the VGG-16 convolutional neural network where VGG-16, as an efficient CNN architecture, has demonstrated excellent performance in multiple classification missions. The experimental results demonstrate that the VGG-16 intrusion detection model achieves 100% accuracy in binary classification and 99% accuracy in six-class classification tests. The CAN intrusion detection model, with the help of behavior feature learning, assists defenders in identifying relevant threats in in-vehicle networks, facilitating the development of protective measures.