A Multiple Rxc3xa9nyi Entropy Based Intrusion Detection System for Connected Vehicles In this paper, we propose an intrusion detection system based on the estimation of the Renyi entropy with multiple orders. The Renyi entropy is a generalized notion of entropy that includes the Shannon entropy and the minentropy as special cases. In 2018, Kim proposed an efficient estimation method for the Renyi entropy with an arbitrary real order    xcexb1   . In this work, we utilize this method to construct a multiple order, Renyi entropy based intrusion detection system (IDS) for vehicular systems with various network connections. The proposed method estimates the Renyi entropies simultaneously with three distinct orders, two, three, and four, based on the controller area network (CAN)IDs of consecutively generated frames. The collected frames are split into blocks with a fixed number of frames, and the entropies are evaluated based on these blocks. For a more accurate estimation against each type of attack, we also propose a retrospective sliding window method for decision of attacks based on the estimated entropies. For fair comparison, we utilized the CANID attack data set generated by a research team from Korea University. Our results show that the proposed method can show the false negative and positive errors of less than 1% simultaneously.

Evaluation Framework for Network Intrusion Detection Systems for InVehicle CAN Modern vehicles are complex safety critical cyber physical systems, that are connected to the outside world, with all security implications it brings. Different network intrusion detection systems (NIDSs) proposed for the CAN bus, the predominant type of invehicle network, to improve security are hard to compare due to disparate evaluation methods adopted. In this paper we provide the means to compare CAN NIDSs on equal footing and evaluate the ones detailed in the literature. Based on this we observe some limitation of existing approaches and why in the CAN setting it is intrinsically difficult to distinguish benign from malicious payload. We argue that xe2x80x9cmeaningawarexe2x80x9d detection (a concept we define) which is challenging (but perhaps not impossible) to create for this setting.