CAN Bus Intrusion Detection Using Ensemble Clustering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In-vehicle networks are largely unprotected from adversarial attacks, with existing intrusion detection systems relying on unsupervised learning methods that are limited by the use of a single linkage function and fail to detect malicious CAN traffic effectively.
Innovation Solution
Implementing an ensemble hierarchical agglomerative clustering (E-HAC) algorithm using multiple linkage functions and metrics to analyze CAN bus traffic, combining unsupervised and ensemble learning approaches for anomaly detection, and employing feature extraction, normalization, and dimensionality reduction to enhance intrusion detection accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If a single linkage function is used in unsupervised learning for intrusion detection, then the system complexity is reduced, but the detection accuracy of malicious CAN traffic deteriorates
Solution Approach 1:
The patent combines multiple linkage functions (single linkage, complete linkage, average linkage, Ward linkage) into an ensemble hierarchical agglomerative clustering system. Each linkage function processes the CAN traffic data independently, and their results are merged to produce the final intrusion detection output. This merging approach resolves the contradiction by maintaining low individual complexity while achieving high collective detection accuracy through the synergistic effect of multiple algorithms.
2Measurement precision
If multiple linkage functions and metrics are used in the E-HAC algorithm, then the detection accuracy of malicious traffic is improved, but the computational complexity increases
Solution Approach 1:
The patent segments the intrusion detection task into multiple independent clustering processes, each using a different linkage function and distance metric combination. By dividing the complex detection problem into smaller, manageable segments that can be processed in parallel, the system achieves high detection accuracy while controlling computational complexity through modular design and efficient resource utilization.
3Measurement precision
If feature extraction and dimensionality reduction are applied, then the intrusion detection accuracy is enhanced, but the processing time increases
Solution Approach 1:
The patent applies feature extraction and dimensionality reduction as preliminary actions before the main intrusion detection process. By pre-processing the CAN traffic data to extract relevant features and reduce dimensionality beforehand, the system enhances detection accuracy while minimizing processing time during the actual detection phase. This preliminary preparation reduces the computational burden on the clustering algorithms.
Data Source
AI summary
Discussed herein are devices, systems, and methods for detecting anomalous or malicious processes based on in-vehicle network traffic data. A method includes receiving, at a monitor device, a controller access network (CAN) bus packet from an electronic control unit (ECU), implementing an ensemble hierarchical agglomerative clustering (E-HAC) algorithm to identify respective clusters to which the CAN bus data maps, and determining, based on the identified respective clusters, whether the CAN bus packet is associated with in-vehicle network intrusion.