In-vehicle network intrusion detection using unsupervised learning
Discussed herein are devices, systems, and methods for detecting anomalous or malicious processes based on in-vehicle network traffic data. A method includes receiving, at a monitor device, a controller access network (CAN) bus packet from an electronic control unit (ECU), implementing an ensemble hierarchical agglomerative clustering (E-HAC) algorithm to identify respective clusters to which the CAN bus data maps, and determining, based on the identified respective clusters, whether the CAN bus packet is associated with in-vehicle network intrusion.
1 . A device of an in-vehicle network, the device comprising:
at least one memory including instructions stored thereon; and
processing circuitry configured to execute the instructions, the instructions, when executed, cause the processing circuitry to perform operations comprising:
receiving a controller access network (CAN) bus packet from an electronic control unit (ECU);
implementing an ensemble hierarchical agglomerative clustering (E-HAC) algorithm, the E-HAC algorithm implementing multiple HAC algorithms on the CAN bus packet to identity respective clusters to which the CAN bus packet maps in relationship to other CAN bus packets, wherein each CAN bus packet is treated as a separate observation for each HAC evaluation in the clustering analysis, with at least two different distance measures and at least two different linkage functions used by said HAC the E-HAC, wherein each of said HAC algorithms of the E-HAC algorithm operates using a distinct combination of a linkage function and a distance measure pair within said E-HAC, and wherein each of the respective clusters is associated with a designation of either malicious behavior or benign behavior;
identifying a mode of the designation of the respective clusters; and
determining the CAN bus packet that is associated with a network intrusion responsive to identifying the mode of the designation is malicious behavior and the results of the identification of respective clusters using the E-HAC algorithm.
2 . The device of claim 1 , wherein the E-HAC algorithm determines the CAN bus packet is benign responsive to identifying the mode of the designation is benign behavior.
3 . The device of claim 1 , wherein the linkage functions include two or more of Ward, average, simple, or complete linkage.
4 . The device of claim 1 , wherein the distances include two or more of L 1 , L 2 , or cosine.
5 . The device of claim 1 , wherein data of the CAN bus packets conforms to 11939 Standards.
6 . The device of claim 5 , wherein the operations further comprise: extracting features of the CAN bus packet and
wherein the HAC algorithms of the E-HAC algorithm operate on the extracted features to cluster the CAN bus packet.
7 . The device of claim 6 , wherein the features include two or more of engine rotations per minute (RPM), vehicle speed, coolant temperature, engine oil level, oil pressure, fuel level, handbrake applied, distance to service, fuel consumption per unit distance or time, or coolant level.
8 . A non-transitory machine-readable medium including instructions that, when executed by a machine, cause the machine to perform operations for in-vehicle network intrusion detection, the operations comprising:
receiving a controller access network (CAN) bus packet from an electronic control unit (ECU);
implementing an ensemble hierarchical agglomerative clustering (E-HAC) algorithm, the E-HAC algorithm implementing multiple HAC algorithms on the CAN bus packet to identify respective clusters to which the CAN bus packet maps in relationship to other CAN bus packets, wherein each CAN bus packet is treated as a separate observation for each HAC evaluation in the clustering analysis, with at least two different distance measures and at least two different linkage functions used by said HAC algorithms of the E-HAC, wherein each of said HAC algorithms of the E-HAC algorithm operates using a distinct combination of a linkage function and a distance measure pair within said E-HAC, and wherein each of the respective clusters is associated with a designation of either malicious behavior or benign behavior;
identifying a mode of the designation of the respective clusters: and
determining the CAN bus packet that is associated with in-vehicle network intrusion responsive to identifying the mode of the designation is malicious behavior and the results of the identification of respective clusters using the E-HAC algorithm.
9 . The non-transitory machine-readable medium of claim 8 , wherein the E-HAC algorithm determines the CAN bus packet is benign if responsive to identifying the mode of designation is benign behavior.
10 . The non-transitory machine-readable medium of claim 8 , wherein the linkage functions include two or more of Ward, average, simple, or complete linkage.
11 . The non-transitory machine-readable medium of claim 8 , wherein the distances include two or more of L1, L2, or cosine.
12 . The non-transitory machine-readable medium of claim 8 , wherein data of the CAN bus packet conforms to Jl939 Standards.
13 . The non-transitory machine-readable medium of claim 12 , wherein the operations further comprise:
extracting features of the CAN bus packet; and
wherein the HAC algorithms operate on the extracted features to duster the CAN bus packet.
14 . The non-transitory machine-readable medium of claim 13 , wherein the features include two or more of engine rotations per minute (RPM), vehicle speed, coolant temperature, engine oil level, oil pressure, fuel level, handbrake applied, distance to service, fuel consumption per unit distance or time, or coolant level.
15 . A method for in-vehicle network intrusion detection, the method comprising
receiving, at a monitor device, a controller access network (CAN) bus packet from an electronic control unit (ECU);
implementing an ensemble hierarchical agglomerative clustering (E-HAC) algorithm, the E-HAC algorithm implementing multiple HAC algorithms on the CAN bus packet to identify respective clusters to which the CAN bus packet maps in relationship to other CAN bus packets, wherein each CAN bus packet is treated as a separate observation for each HAC evaluation in the clustering analysis,
with at least two different distance measures and at least two different linkage functions used by said HAC algorithms of the E-HAC, wherein each of said HAC algorithms of the E-HAC algorithm operates using a distinct combination of a linkage function and a distance measure pair within said E-HAC, and wherein each of the respective clusters is associated with a designation of either malicious behavior or benign behavior;
identifying a mode of the designation of the respective clusters; and
determining the CAN bus packet that is associated with in-vehicle network intrusion responsive to identifying the mode of the designation is malicious behavior and the results of the identification of respective clusters using the E-HAC algorithm.
16 . The method of claim 15 , wherein determining whether the E-HAC algorithm determines the CAN bus packet is benign responsive to identifying the mode of the designation is benign behavior.
17 . The method of claim 15 , wherein the linkage functions include two or more of Ward, average, simple, or complete.
18 . The method of claim 15 , wherein the distances include two or more of L1, L 2, or cosine.
19 . The method of claim 15 , wherein data of the CAN bus packet conforms to J1939 Standards.
20 . The method of claim 19 , further comprising: extracting features of the CAN bus packet; and
wherein the E-HAC algorithm operates on the extracted features to cluster the CAN bus packet.
21 . The device of claim 1 , wherein the processing circuitry is configured to execute the instructions that cause the processing circuitry to perform converting multiple vehicle characteristics and conditions to a corresponding normalized and dimensionally reduced set of numerical feature values, wherein determining the CAN bus packet is associated with network intrusion includes determining the CAN bus packet is associated with a network intrusion or is not associated with a network intrusion as a function of the number of respective clusters to which the CAN bus packet maps associated with malicious behavior and the number of respective clusters associated with benign behavior, and wherein the CAN bus packet is determined to be associated with an intrusion if a majority of identified respective clusters to which the CAN bus maps is associated with malicious behavior, and the CAN bus packet is determined to be associated with a benign behavior if a majority of identified respective clusters to which the CAN bus maps is associated with benign behavior.
22 . The method of claim 15 , further comprising converting multiple vehicle characteristics and conditions to a corresponding normalized and dimensionally reduced set of numerical feature values, wherein the determining step includes determining the CAN bus packet is associated with a network intrusion or is not associated with a network intrusion as a function of the number of respective clusters to which the CAN bus packet maps associated with malicious behavior and the number of respective clusters associated with benign behavior, and wherein the CAN bus packet is determined to be an intrusion if a majority of identified respective clusters to which the CAN bus maps is associated with malicious behavior, and the CAN bus packet is determined to be benign if a majority of identified respective clusters to which the CAN bus maps is associated with benign behavior.