# Windowed Hamming Distance-Based Intrusion Detection for the CAN Bus
## 7 Conclusions  
The primary objective of this research was to develop an intrusion detection method specifically designed for the Internet of Vehicles. We accomplished this by analyzing the data frames of the vehicle network which undergo significant changes when injected with malicious data. By calculating the Hamming distance between the vehicle data in the attacked state and the benchmark that records the original state of the vehicle, we were able to quantify the differences. To optimize resource usage, we established a threshold-based approach to determine whether a vehicle is under attack.  
We validated the effectiveness of our methodology by conducting experiments on two datasets: one publicly available dataset and another dataset that we collected and simulated attacks on. The experimental results demonstrate that our method exhibits robust detection capabilities for DoS attacks, fuzzy attacks, and two types of spoofing attacks, achieving high accuracies of 99.67%, 98.66%, 99.4%, and 99.61%, respectively. Furthermore, it demonstrates strong F1 scores of 99.61%, 98.02%, 99.27%, and 99.48% for these attack categories. In comparison to other methods that utilize sliding windows [13], our method achieves a notable improvement in accuracy, surpassing it by 3.49%. Furthermore, in terms of resource consumption, our method outperforms the DCNN method [9]. Specifically, our method significantly reduces the detection time by nearly 20 times, optimizing it from 6.7 ms to 0.37 ms. Additionally, it substantially reduces the memory footprint by almost 1000 times. Our method effectively detects common injection attacks on CAN buses while minimizing memory usage and time consumption.  
Lastly, we discussed how our approach can recognize different kinds of attacks and has some extra abilities. In our future work, we aim to enhance several aspects of our methodology, including the facilitation of benchmark selection, bolstering method robustness, and expanding the repertoire of reliably detectable attack types.  
Preliminary research, methodology, experiments, and draft preparation: S.F.; Data provision and methodological guidance: G.Z.; Draft revision: J.L.; Supervision and funding acquisition: Y.L. All authors have read and agreed to the published version of the manuscript.  
This work was supported by Henan Science and Technology Major Project (No. 221100240100), National Science Foundation of China (No. 62002213), Shanghai Sailing Program (21 YF1413800 and 20 YF1413700), Shanghai Science and Technology Innovation Action Plan (No. 21511102500), and Science and Technology on Communication Security Laboratory Foundation (No. 6142103022208).  
Not applicable  
The car-hacking dataset utilized in our experiments originates from the HCRL (Highly Confidential Research Lab). The dataset can be acquired at [[https://ocslab.hksecurity](https://ocslab.hksecurity)]([https://ocslab.hksecurity](https://ocslab.hksecurity)).  
net/Datasets/car-hacking-dataset. The XiaoYu dataset presented in this study are available on request from the corresponding author due to privacy.  
The authors declare no conflict of interest.