# HP-LSTM: Hawkes Process-LSTM-Based Detection of DDoS Attack for In-Vehicle Network
###### Abstract  
Connected and autonomous vehicles (CAVs) are advancing at a fast speed with the improvement of the automotive industry, which opens up new possibilities for different attacks. A Distributed Denial-of-Service (DDoS) attacker floods the in-vehicle network with fake messages, resulting in the failure of driving assistance systems and impairment of vehicle control functionalities, seriously disrupting the normal operation of the vehicle. In this paper, we propose a novel DDoS attack detection method for in-vehicle Ethernet Scalable service-Oriented Middleware over IP (SOME/IP), which integrates the Hawkes process with Long Short-Term Memory networks (LSTMs) to capture the dynamic behavioral features of the attacker. Specifically, we employ the Hawkes process to capture features of the DDoS attack, with its parameters reflecting the dynamism and self-exciting properties of the attack events. Subsequently, we propose a novel deep learning network structure, an HP-LSTM block, inspired by the Hawkes process, while employing a residual attention block to enhance the model's detection efficiency and accuracy. Additionally, due to the scarcity of publicly available datasets for SOME/IP, we employed a mature SOME/IP generator to create a dataset for evaluating the validity of the proposed detection model. Finally, extensive experiments were conducted to demonstrate the effectiveness of the proposed DDoS attack detection method. Hawkes process; LSTM; DDoS; SOME/IP +
Footnote †: journal:  
0000-0001-5000-0000-0000-00000-0000-000  
platforms. By generating excessive network traffic, attackers hinder legitimate users and vehicle control systems from accessing essential network resources, thus posing severe security risks. Given the increasing reliance on network connectivity and automation in modern vehicles, DDoS attacks present significant challenges to the security of CAVs. The increasing number of ECUs and the development of infotainment systems have led to the emergence of in-vehicle Ethernet with ultra-high bandwidth [9; 10]. The main driving forces behind this trend are the growing demand for computational and communication bandwidth, as well as the need for flexibility in adding software [11]. In this case, the SOME/IP, unique for its communication mechanism, has seen rapid development since being proposed by BMW in 2011. However, the lack of a robust security architecture in SOME/IP has made it a target for various network attacks, including DDoS attacks [3; 12]. In addition, in contrast to the considerable attention garnered by the CAN bus within research circles [13], in-vehicle Ethernet has received relatively less scrutiny, exacerbating the scarcity of publicly available datasets pertaining to SOME/IP. This scarcity notably complicates research efforts aimed at understanding network attacks targeting SOME/IP. To overcome the above challenges, we propose a novel detection method for DDoS attacks on SOME/IP, called HP-LSTM. Initially, we model the SOME/IP communication data using the Hawkes process, wherein the Hawkes parameters reflect the dynamism and self-exciting properties of the attack events, taking into account the dynamic behavior characteristics of attackers. Subsequently, we propose a simple yet efficient deep learning network for detecting DDoS attack. The network is combined with multiple HP-LSTM blocks, residual self-attention blocks, Packet Mapping blocks, and MLPs. HP-LSTM blocks capture complex temporal features that original LSTM blocks cannot by introducing Hawkes parameters to our well-designed structure. The code is available at the following link: [[https://github.com/jamesnuliu/HP-LSTM/](https://github.com/jamesnuliu/HP-LSTM/)]([https://github.com/jamesnuliu/HP-LSTM/](https://github.com/jamesnuliu/HP-LSTM/)) (accessed on 20 May 2024).