论文标题
Candito：改善基于有效载荷的控制器区域网络攻击的检测
CANdito: Improving Payload-based Detection of Attacks on Controller Area Networks
论文作者
论文摘要
多年来，越来越复杂且相互联系的车辆提出了针对机上网络有效，有效的入侵检测系统的需求。鉴于严格的领域要求以及在控制器区域网络传输的信息的异质性，已经提出了多种方法，它们在不同的抽象水平和粒度上起作用。其中，基于RNN的解决方案因其表现和有希望的结果而引起了研究界的关注。在本文中，我们改善了Cannolo，这是一种基于RNN的最先进的ID，通过提出Candito，是一种无监督的ID，它利用长期短期记忆自动编码器通过信号重建过程来检测异常。我们通过在现实世界中注入的一组全面的合成攻击数据集中测量其有效性来评估坎蒂托的有效性。我们证明了在注射了一系列综合攻击的现实数据集中，在检测和时间性能方面，坎蒂托的改进。
Over the years, the increasingly complex and interconnected vehicles raised the need for effective and efficient Intrusion Detection Systems against on-board networks. In light of the stringent domain requirements and the heterogeneity of information transmitted on Controller Area Network, multiple approaches have been proposed, which work at different abstraction levels and granularities. Among these, RNN-based solutions received the attention of the research community for their performances and promising results. In this paper, we improve CANnolo, an RNN-based state-of-the-art IDS for CAN, by proposing CANdito, an unsupervised IDS that exploits Long Short-Term Memory autoencoders to detect anomalies through a signal reconstruction process. We evaluate CANdito by measuring its effectiveness against a comprehensive set of synthetic attacks injected in a real-world CAN dataset. We demonstrate the improvement of CANdito with respect to CANnolo on a real-world dataset injected with a comprehensive set of attacks, both in terms of detection and temporal performances.
