IDS in the CAN bus using Statistical
Analysis and Neural Networks
Araya Kibrom Desta, Ismail Arai, Kazutoshi Fujikawa
Nara Institute of Science and Technology, Inet-Lab
5. Future Work+*,-After we calculated Tt, the corresponding pvalue is solved , and if the p-value is less thana predefined threshold(0.26), the detector
alerts the driver to take appropriate measures.

P value

Present-day vehicles are equipped withmultiple Electronic Control Units(ECUs), eachof which communicate with one another using
a protocol called Controller Area
Network(CAN).
Even though, CAN provides its own share ofbenefits in modernizing automobiles, it also
opens a new security hole in the automotiveindustry. CAN bus doesn’t use any mechanism
for encrypting or authenticating CAN packets.
Security researchers have been able to exploit
this security hole to remotely control somecritical car components. As a counter measureagainst this drawback two methodologies ofdefense, Prevention and Detection, have beenproposed. But due to the low processing
power of ECUs and a desire of unaltering theCAN de facto standard, we are mainly focusingon a mechanism to detect intrusions inside theCAN bus.

&'(&)'

Threshold

True positive rate= 0.9
False Positive rate= 0.88

TimeFig1: Blue dots are benign CAN packets and red dots
represent anomalies.

2. IDS using One Class Support Vector
Machine[2] ,we trained OCSVM against Np, μt and σ2t

2. Purpose of the Research

Each CAN packet, along side with otherinformation, has an arbitration ID and timing
information. Using this two information and thefact that CAN packets appear in the CAN bus ata fixed frequency[1], we aim to detect malicious
message sequences in a fixed time window.
Given the available information from the CAN
bus and knowledge of attack signatures, wehave evaluated some statistical methods thatcan effectively identify CAN attacks.

3. Replication of existing Researches
To evaluate the methods, we have collected 10
minutes of CAN data from a real car.
1. One Sample/Universal t-test method[2]This anomaly Detection approach works by
calculating statistical data about on going
network traffic and comparing them withhistorical values (!"#) measured during training.
In every 1 second, we collected the following
information for each arbitration ID.
ü ID: arbitration ID
ü Np : the number of packets in the flowü μt: the average time difference between
successive packets
ü σ2t: the variance of the time difference
between successive packets
ü Tt: the time difference test value

Arbitration ID 32
Arbitration ID 295

32

Arbitration ID

1728

Fig3: Packet count of all arbitration IDs in one second.

In our research we are trying to improvesome of the methodologies described here
and we will also use sequences of CANpacket data portion to identify anomalies.
A simple strategy for general sequencelearning is to use RNN with LSTM[3].

Fig2: data view for IDs 32 and 295

The training gave us good results forboth insertion and drop attacks.
Fig5: Module in an LSTM[4]With this technology, we will predict data
frames using the trained network anddepending on how close our prediction
was with the actual received data frame,
we will determine whether a data
sequence has an anomaly or not.

True Positive rate

The main purpose of this research is to detectcyber attacks inside CAN bus by using different
statistical anomaly detection methods andLong Short Term Memory(LSTM) Recurrent
Neural Networks(RNN). We will train a neuralnetwork to predict subsequent packets, using
data from sequences of previously seen
messages on the CAN bus. The error difference
found by evaluating the actual value and thepredicted value will be used for detecting
anomalies in a sequence of CAN Packets.

Most of the methods described here mainly
focus on periodicity and timing information ofCAN packets. None of the methods used any
information from the data portion of thepackets. And we believe the optimal time thata user should be notified about an intrusion
should be in about 1 second. But, for periodic
messages which appear in the CAN bus inaverage of later than 1 second it is impossible
to notify the driver before the intrusions causemuch more damage.

Count

1. Introduction$# =False Positive rate
Fig3: ROC curve for arbitration IDs 32 and 295
References[1] Song, Intrusion detection system based on the analysis of timeintervals of CAN messages for in-vehicle network. InternationalConference on Information Networking. Vol. 2016-March IEEE
Computer Society, 2016. pp. 63-68[2] A. Taylor, N. Japkowicz, and S. Leblanc, “Frequency-based anomaly
detection for the automotive CAN bus,” in Proc. 2015 World Congress on
Industrial Control Systems Security (WCICSS), Dec. 2015, pp. 45–49.

4. Discussion
OCSVM method is more efficient in detecting
very short insertion and drop attacks at anacceptable rate, it is even possible to get morepractical positive false alarm rates with ahigher training data compared to t-test
method. In case of the t-test method, its
performance can be improved by selecting anoptimal threshold value. The training data weused to experiment all the methods are only
periodic CAN messages, but all theaforementioned methods fail to detect any
anomaly sent with a non-periodic arbitration
ID.

The advantage of using RNN over thestatistical methods is, unlike statisticalmethods RNN have a better anomaly
detection capability for a short term
anomalies. RNN will also be able to detect
anomalies arriving in the CAN bus with
non-periodic arbitration IDs.
Furthermore, We will continue to tweak
LSTM for better accuracy results and try tocontinue digging on how to use RNN for
identifying anomalies that appear during
abnormal car states, like intrusion
detection during car crashes. Intrusion
detection during this state can be moredifficult due to abrupt data packet
information changes.
References[3] F.A. Gers, J. Schmidhuber, and F. Cummins. Learning toforget: continual prediction with LSTM. Neural Computation,
12(10):2451–2471, 2000.
[4] http://colah.github.io/posts/2015-08-UnderstandingLSTMs/Contact Information
Araya.kibrom_Desta.js3@is.naist.jp{Ismail,fujikawa}@itc.naist.jp