# Windowed Hamming Distance-Based Intrusion Detection for the CAN Bus
## 2 Related Work  
In the era of rapid Internet development, automotive CAN buses are becoming increasingly susceptible to attacks. For example, the identifier (ID) information of the vehicle is obtained by the attacker through reverse engineering so as to control the entire vehicle [15] or through injection attacks, which make the brakes of the vehicle fail, the engine act abnormally, etc. [4; 6; 16]. In [6], the researchers use cyberattacks which triggered the recall of 1.4 million vehicles. Hence, it is an urgent mission to add a security mechanism to the CAN bus. The solutions to the problems are divided into two types, namely IDS and MAC [17; 18; 19; 20]. For example, in [20], the author proposes a new authentication protocol, MAuth-CAN, that is secure against spoofing attacks. Unfortunately, there are some serious problems with this strategy, such as its impact on performance; most of MAC methods impose a burden on the CAN bus load [11]. Existing IDS are basically divided into neural network methods [14; 21; 22; 23; 24; 25; 26; 27; 28; 29; 30], traditional machine learning methods [31; 32; 33; 34; 35], and other efficient statistics methods that utilize the characteristics of the CAN bus [10; 13; 26; 36; 37; 38; 39; 40; 41; 42; 43; 44; 45; 46]. In the methods related to neural networks, as in Refs. [14; 22], Generative Adversarial Network (GAN) and Long Short-Term Memory (LSTM) methods, two neural networks commonly employed for generation and prediction, are used, respectively, to build an autoencoder to reconstruct new data by learning normal behavior data. They analyze the variances between the reconstructed data and the original data to detect attacks. In [23] [PERSON], [PERSON] et al. build a reinforcement learning model against Spoofing attacks using electrical signals from the ECU's physical layer. In [26], [PERSON] et al. use their own simplified Inception-ResNet to obtain amazing results on the CAN bus. The disadvantage of the deep learning method is also obvious, namely in that it cannot meet the requirements of the hardware environment of the vehicle. In contrast, the time and space complexity of traditional machine learning and other methods that utilize the characteristics of the bus is not very high, which is more practical and can be used in real vehicles. [PERSON] et al. [37] find that the ID has a certain fixed pattern between the loops of an ID. When the car is attacked, the injected data change the inherent pattern between the ID loops. This technique is used primarily for injection assaults to determine whether it has been invaded. However, the study's results show that this method's accuracy is only 93.5%. [PERSON], [PERSON] et al. [32] propose a machine learning method named support vector domain description (SVDD) and, combined with Markov chains, realize IDS. SVDD is a one-class SVM model; it only needs to learn normal data so the data within its range are not considered abnormal data. In the study conducted by [PERSON] et al. [34], the researchers propose the utilization of ensemble methods with Kappa architecture for detecting attacks. However, their method falls short in terms of detection efficiency, with an accuracy of 98.5% and an F-score of 98.5% when compared to the performance of our method. Certainly, each ID has an almost fixed frequency is an important characteristic of the CAN bus. In studies [26; 39; 40], researchers use the frequency or time interval methods of ID to detect attacks. When an injection attack occurs, the frequency or time interval of the ID varies, so this is a useful characteristic. [PERSON], [PERSON] et al. [31] propose the gradient boosting decision tree (GBDT) model to classify each frame. In [41; 42], the authors also use entropy to measure IDS and define the threshold by calculating the entropy change in a fixed ID. The above methods determine whether each packet is a normal packet or not according to CAN bus characteristics. This approach is somewhat contingent, and sometimes it loses the CAN bus time series characteristics.