PaperlayerView exact revision on arXiv

Source-linked AI summary

Deep Transfer Learning Based Intrusion Detection System for Electric Vehicular Networks

Sk. Tanzir Mehedi, Adnan Anwar, Ziaur Rahman, Kawsar Ahmed

arXiv:2107.05172v1cs.CRcs.AI

TL;DR

Connected, increasingly complex IVNs remain exposed to CAN message injection, while evolving threats challenge traditional machine-learning detection. The paper formulates a transfer-learning LeNet IDS and reports 98.10% overall accuracy, higher than benchmark ML, DL, and DTL models.

  • Problem

    Connected, increasingly complex IVNs remain exposed to malicious CAN-message injection, while evolving threats challenge traditional machine-learning-based IDSs.

    Source: §1 · p. 2, §3.1 · p. 7

  • Method

    The authors formulate transfer between binary-labeled source and target domains and use a seven-layer P-LeNet intrusion-detection architecture.

    Source: §3.2 · p. 8, §3.3 · p. 9

  • Results

    98.10% overall accuracy was reported for P-LeNet, a noticeable improvement over benchmark ML, DL, and DTL models.

    Source: §6 · p. 20

  • Takeaways & Limitations

    P-LeNet classifies normal versus abnormal CAN traffic and allows immediate anomaly detection, as reported by the authors.

    Source: §6 · p. 20

    The transfer setup assumes source and target labels distinguish only normal from attack data, although attacks and feature behavior may differ between domains.

    Source: §3.2 · p. 8

Abstract

from arXiv · show

The Controller Area Network (CAN) bus works as an important protocol in the real-time In-Vehicle Network (IVN) systems for its simple, suitable, and robust architecture. The risk of IVN devices has still been insecure and vulnerable due to the complex data-intensive architectures which greatly increase the accessibility to unauthorized networks and the possibility of various types of cyberattacks. Therefore, the detection of cyberattacks in IVN devices has become a growing interest. With the rapid development of IVNs and evolving threat types, the traditional machine learning-based IDS has to update to cope with the security requirements of the current environment. Nowadays, the progression of deep learning, deep transfer learning, and its impactful outcome in several areas has guided as an effective solution for network intrusion detection. This manuscript proposes a deep transfer learning-based IDS model for IVN along with improved performance in comparison to several other existing models. The unique contributions include effective attribute selection which is best suited to identify malicious CAN messages and accurately detect the normal and abnormal activities, designing a deep transfer learning-based LeNet model, and evaluating considering real-world data. To this end, an extensive experimental performance evaluation has been conducted. The architecture along with empirical analyses shows that the proposed IDS greatly improves the detection accuracy over the mainstream machine learning, deep learning, and benchmark deep transfer learning models and has demonstrated better performance for real-time IVN security.

1. Introduction

The introduction motivates intrusion detection for increasingly connected, vulnerable IVNs and proposes a deep transfer learning-based LeNet model. It reports that the model outperforms other approaches.

1. Introduction

  • As IVNs add connected devices and become more complex, their links to external networks increase exposure to internal and external threats.Source: §1 · p. 1
  • CAN remains central to automotive IVNs because its real-time flexibility and message prioritization make replacement require a complete redesign.Critical messages, such as engine-control messages, take precedence over lower-priority messages such as door-control messages.Source: §1 · p. 2
  • Evolving IVNs and threats motivate updating traditional machine-learning IDSs, while deep learning and deep transfer learning have attracted cybersecurity research interest.Source: §1 · p. 2
  • Because CAN does not encrypt data, attackers can interpret packets and inject malicious messages that create abnormal traffic detectable by an IDS.Source: §1 · p. 2
  • The authors propose a DTL-LeNet IDS and evaluate it on heterogeneous real-time data, identifying useful features and comparing TML, DL, and DTL approaches.Source: §1 · p. 2
  • The proposed deep transfer learning-based LeNet model outperforms other approaches in the reported evaluation.The introduction describes extensive analysis and performance evaluation but gives no numerical comparison here.Source: §1 · p. 3

2. Background and Related Work

The background describes CAN's security weaknesses and surveys intrusion-detection research for in-vehicle networks. It identifies limits in prior IDS coverage and discusses transfer learning as a basis for detecting varied CAN attacks.

2.1. Background of CAN and Security Vulnerabilities

  • CAN lacks encryption and authentication, and its frames include data, remote, error, and overload types with distinct roles.The data frame carries data, remote frames request messages, error frames signal detected errors, and overload frames add delay.Source: §2.1 · p. 3

2. Background and Related Work

  • Earlier IDS work addresses vulnerabilities and evolving attack routes, including malicious-message injection and remote ECU compromise through OTA updates.Source: §2 · p. 3, §2.1 · p. 4

2.2. TML and DL Based IDSs for IVN

  • Prior IVN IDS studies span multiple algorithms and attacks, but many use small networks or detect attacks without classifying their types.The review organizes systems by detection algorithm, accuracy, robustness, and coverage.Source: §2.2 · p. 5

2.3. DTL Based IDSs for IVN

  • DTL reuses knowledge from previously trained models, and the paper positions its approach as an update for detecting varied complex CAN attacks.The review also notes that prior IoV transfer learning improved detection accuracy by at least 23% over existing TML and DL methods.Source: §2.3 · p. 6

3. Proposed Solution

The proposal targets CAN-bus intrusion detection across flooding, fuzzing, and spoofing attacks, under the constraints of real-time vehicular systems. It transfers source-domain knowledge and combines it with target-domain data in a P-LeNet IDS.

3.1. Problem Statement

  • Flooding, fuzzing, and spoofing are the three considered attacks, involving resource-consuming high-priority messages, random frames, and messages sent with fake IDs.The paper describes these as attack scenarios against in-vehicle networks.Source: §3.1 · p. 7, Figure 3 · p. 7
  • Complex embedded systems and limited processing and memory resources make standard IDS measures impractical, motivating detection of normal and abnormal traffic and immediate anomaly detection.Figure 4 illustrates the proposed intrusion-detection mechanism for vehicular-network traffic.Source: §3.1 · p. 7, Figure 4 · p. 8

3.2. Solution Formulation

  • The proposed P-LeNet transfers knowledge from source-domain data and combines it with target-domain data to improve IDS detection accuracy across electric vehicular ecosystems.The paper states that source-trained models do not achieve excellent accuracy on target-domain data.Source: §3.2 · p. 8

3.3. Architecture

  • P-LeNet has seven layers and 12,052 trainable parameters, while its training and intrusion-detection stages use a model selected for validation-set prediction performance.The architecture includes two convolutional layers, two subsampling layers, a flatten layer, a fully connected layer, and an output layer.Source: §3.3 · p. 9, Figure 5 · p. 9, Figure 6 · p. 10

4. Materials and Methods

The methods combine two labeled CAN datasets, clean and transform their records, and evaluate selected traditional, deep-learning, and transfer-learning classifiers. The evaluation uses separate training, validation, and test partitions.

4.1. Dataset Description

  • The combined dataset contains 1,270,310 instances and five features: Timestamp, CAN_ID, DLC, Data_Field, and Label, with labels distinguishing normal from attack messages.The source datasets comprise normal driving data and abnormal driving data collected during an attack.Source: §4.1 · p. 10

4.2. Data Preparation

  • Data preparation is organized into cleaning, integration, and transformation to prepare records for the selected TML, DL, and DTL methods.The stated preparation goals include removing unnecessary features, handling non-numeric values, and removing outliers.Source: §4.2 · p. 11

4.2.1. Data Cleaning

  • Cleaning removed noise and inconsistencies, imputed missing values with Predictive Mean Matching, converted hexadecimal fields, and omitted Timestamp from feature vectors to avoid possible overfitting.After cleaning, 1,257,303 records remained; Data_Field values could be up to 152 bits.Source: §4.2.1 · p. 11

4.2.2. Data Integration

  • Feature integration used Pearson correlation with a p < 0.05 cutoff to assess relationships, including whether CAN_ID implies Data_Field, and aimed to reduce redundancy.The authors describe redundancy reduction as a way to improve training and validation accuracy and speed.Source: §4.2.2 · pp. 11–12

4.2.3. Data Transformation

  • Minimum–maximum normalization rescales selected feature values to the range [0.0, 1.0] without changing the original data characteristics.The normalized output is defined using each feature's original value and its minimum and maximum.Source: §4.2.3 · p. 12

4.3. Training Process

  • The split left 1,005,843 training records and 251,460 test records after cleaning, then divided training data into 804,674 training and 201,169 validation records.The initial train/test split was 80%/20%, followed by an 80%/20% split of the training partition.Source: §4.3 · p. 12, Figure 8 · p. 13
  • The evaluated traditional classifiers were Decision Tree, Random Forest, SVM, and KNN; deep-learning models included NN, RNN, CNN, and LSTM.The LSTM configuration used three hidden layers with 128, 100, and 64 units.Source: §4.3 · p. 13, Table 4 · p. 14
  • The transfer-learning comparison included FCN, Inception Network, ResNet, and proposed P-LeNet, with Adam used as optimizer across the selected models.P-LeNet used two hidden layers with 5 and 20 units.Source: §4.3 · p. 14, Table 5 · p. 14

5. Results

The evaluation compares traditional machine learning (TML), deep learning (DL), and deep transfer learning (DTL) models using multiple performance indicators and varied model parameters. On the same dataset, DTL models performed better in most cases, with P-LeNet outperforming the other DTL approaches.

5.1. Experimental Evaluation Indicators

  • The evaluation used TP, TN, FP, and FN-based indicators, including accuracy, F1-score, and ROC AUC, across varied model and training parameters.The experiments varied hidden layers and units, epochs, activation and loss functions, and optimizers.Source: §5.1 · pp. 14–15

5.2. TML Models Analysis

  • DT achieved 0.9532 accuracy, 0.9463 precision, 0.9558 recall, 0.9608 F1-score, and 0.8408 ROC AUC, leading the selected TML algorithms.KNN had the lowest accuracy at 0.9248; the passage identifies Figure 9 as the TML performance-metrics comparison.Source: §5.2 · pp. 15–16, Figure 9 · p. 16

5.3. DL Models Analysis

  • LSTM led the selected DL models at 0.9762 accuracy, with 0.9808 precision, 0.9392 recall, 0.8884 F1-score, and 0.9288 ROC AUC.RNN and CNN accuracies were 0.9640 and 0.9590, respectively, and both outperformed most TML models.Source: §5.3 · pp. 16–17, Figure 10 · p. 17

5.4. DTL Models Analysis

  • P-LeNet led the DTL models with 0.9810 accuracy, 0.9814 precision, 0.9804 recall, 0.9783 F1-score, and 0.9542 ROC AUC.The model used two hidden layers with ReLU, softmax output, categorical crossentropy, and Adam.Source: Table 6 · p. 17, §5.4 · p. 17
  • P-LeNet had the highest training and testing accuracy among the DTL models, remaining near 0.9810 through its early-stopping checkpoint.Its accuracy rose to close to 0.9809 by epoch 400; the analysis used 1000 epochs because accuracy curves flattened between epochs 450 and 1000.Source: Figure 12 · p. 18, Figure 11 · p. 18, §5.4 · p. 18
  • P-LeNet had the lowest loss, with a reported loss score of 0.1459 remaining almost constant from epochs 400 to 1000.The passage also reports that IncepNet and ResNet losses declined from about 0.5506 to approximately 0.1409 by epoch 350 and then remained stable.Source: Figure 14 · p. 19, Figure 13 · p. 19, §5.4 · p. 19

5.5. Performance Comparison

  • DTL models performed significantly better in most cases than the other experimental scenarios, and P-LeNet outperformed other DTL approaches in classification accuracy.The paper also reports that P-LeNet had adequate stability and low loss and could identify and classify normal and attack scenarios.Source: §5.5 · pp. 19–20

6. Conclusions

The authors report that P-LeNet outperforms benchmark ML, DL, and DTL models on CAN intrusion detection. They identify decentralized implementation and hyperparameter optimization as future work.

6. Conclusions

  • 98.10% overall accuracy, 98.14% precision, 98.04% recall, 97.83% F1-score, and 95.42% ROC AUC; P-LeNet outperformed benchmark ML, DL, and DTL models.The authors report that it classifies normal and attack scenarios for in-vehicle networks.Source: §6 · p. 20
  • The authors propose extending the model to decentralized devices or servers and optimizing its hyperparameters.Source: §6 · p. 20
  • The authors state that the model could extend to other emerging critical-infrastructure applications involving automation and secure data processing.Source: §6 · p. 20

Abbreviations

Loading 2107.05172v1…