论文标题
评估连接车辆实时入侵检测系统的体系结构替代方案
Evaluation of the Architecture Alternatives for Real-time Intrusion Detection Systems for Connected Vehicles
论文作者
论文摘要
攻击者证明了使用远程访问连接车辆的车辆网络来发射网络攻击并远程控制这些车辆。已经提出了基于机器学习的入侵检测系统（IDS）技术来检测此类攻击。对其中一些ID的评估证明了它们在检测消息注射方面的准确性方面的功效，但是离线进行的，这限制了他们对实时保护方案的使用信心。本文使用控制器区域网络（CAN）数据集评估了四个用于实时ID的体系结构设计，这些数据集是在恶意速度阅读消息注射下从移动车辆中收集的。评估表明，连接车辆设计的连接车辆的实时ID，CAN总线监视的过程以及另一个用于异常检测引擎的过程是可靠的（没有消息丢失），可用于实时弹性机制，以响应网络攻击。
Attackers demonstrated the use of remote access to the in-vehicle network of connected vehicles to launch cyber-attacks and remotely take control of these vehicles. Machine-learning-based Intrusion Detection Systems (IDSs) techniques have been proposed for the detection of such attacks. The evaluation of some of these IDS demonstrated their efficacy in terms of accuracy in detecting message injections but was performed offline, which limits the confidence in their use for real-time protection scenarios. This paper evaluates four architecture designs for real-time IDS for connected vehicles using Controller Area Network (CAN) datasets collected from a moving vehicle under malicious speed reading message injections. The evaluation shows that a real-time IDS for a connected vehicle designed as two processes, a process for CAN Bus monitoring and another one for anomaly detection engine is reliable (no loss of messages) and could be used for real-time resilience mechanisms as a response to cyber-attacks.
