RIDS: 랜덤 포레스트 기반차량 내 네트워크 칩입 탐지 시스템
RIDS: Random Forest-Based Intrusion Detection System for In-Vehicle Network
2
조회
0
다운로드
1
인용
0
참고문헌
키워드
초록
본 논문은 CAN(Controller Area Network) 버스에서 해킹에 의한 공격을 탐지하기 위한 랜덤 포레스트 기반 칩입 감지 시스템(RIDS: Random Forest-Based Intrusion Detection)을 제안한다. RIDS는 CAN 버스에서 나타날 수 있는 전형적인 세 가지 공격, 즉 DoS(Denial of Service) 공격, Fuzzing 공격, Spoofing 공격을 탐지하며, 데이터 프레임 사이의 시간 간격과 그 편차, 페이로드끼리의 해밍 거리와 그 편차의 네 가지 파라미터를 사용하여 공격을 판단한다. RIDS는 메모리 중심 방식의 아키텍쳐를 가지며 노드의 정보를 메모리에 저장하여 사용하며 트리의 개수와 깊이만 조절하면 DoS 공격, Fuzzing 공격, Spoofing 공격을 모두탐지할 수 있도록 확장이 용이한 구조로 설계되었다. 시뮬레이션 결과 RIDS는 정확도 0.9835, F1 점수 0.9545로 세 가지 공격을효과적으로 탐지할 수 있었다.
Abstract
This paper proposes RIDS (Random Forest-Based Intrusion Detection), which is an intrusion detection system todetect hacking attack based on random forest. RIDS detects three typical attacks i.e. DoS (Denial of service) attack,fuzzing attack, and spoofing attack. It detects hacking attack based on four parameters, i.e. time interval betweendata frames, its deviation, Hamming distance between payloads, and its diviation. RIDS was designed in memorycentricarchitecture and node information is stored in memories. It was designed in scalable architecture whereDoS attack, fuzzing attack, and spoofing attack can be all detected by adjusting number and depth of trees. Simulation results show that RIDS has 0.9835 accuracy and 0.9545 F1 score and it can detect three attack typeseffectively.
참고문헌 (19)
- C. Kim, "A Study on the Standard Development Trend for Automotive Security Threats", Review of KIISC, 29(1), pp.20~25 (2019)
- "ISO 21434:2021, Road vehicles - Cybersecurity engineering"[URL]
- "ISO 11898-1:2015, Road vehicles - Controller area network (CAN) - Part 1: Data link layer and physical signalling"[URL]
- 정선우, "LIN", CAN 차량용 인터페이스와 칼만 필터 기능을통합한 차량용 ECU 설계, 2021, pp.25(4), 762~765[DOI]
- "UNECE WP.29, Proposal for a new UN Regulation on uniform provisions concerning the approval of vehicles with regards to cyber security and cyber security management system"[URL]
- L. Breiman, "Random Forests", Machine Learning, 45, pp.5~32 (2001)
- S. Mehedi, "Deep Transfer Learning Based Intrusion Detection System for Electric Vehicular Networks", Sensors, 21(14), pp.4736~ (2021)
- "ISO 15031-1:2010, Road vehicles – Communication between vehicle and external equipment for emissions-related diagnostics - Part 1: General information and use case definition"[URL]
- "Adventures in Automotive Networks and Control Units"[URL]
- H. Park, "Self-Studying Machine Learning +Deep Learning" (2020), Hanbit Media
- H. Lee, "OTIDS: A Novel Intrusion Detection System for In-vehicle Network by using Remote Frame", Proceedings of Annual Conference on Privacy, Security and Trust, pp.57~5709 (2017)
- E. Seo, "GIDS: GANBased Intrusion Detection System for In-Vehicle Network", Proceedings of Annual Conference on Privacy, Security and Trust, pp.1~6 (2018)
- H. Song, "Intrusion Detection System-Based on the Analysis of Time Intervals of Messages for In-Vehicle Network", Proceedings of International Conference on Information Networking, pp.63~68 (2016)
- R. W. Hamming, "Error Detecting and Error Correcting Codes", Bell System Technical Journal, 29(2), pp.147~160 (1950), Institute of Electrical and Electronics Engineers (IEEE)[DOI]
- D. Stabil, "Detecting Attacks to Internal Vehicle Networks through Hamming Distance", Proceedings of AEIT International Annual Conference, pp.1~6 (2017)
- X. Lin, "Random Forest Architectures on FPGA for Multiple Applications", Proceedings of GLS-VLSI, pp.415~418 (2017)