트랜스포머를 활용한 CAN 침입탐지모델
CAN Intrusion Detection Model Using Transformer
1
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
CAN(Controller Area Network)은 차량 내부에 가장 널리 사용되는 네트워크프로토콜로서 민수용 차량뿐만 아니라 군수용 지상무인체계에서도 널리 사용되는표준 프로토콜이지만, CAN 개발 당시에는 통신의 안정성과 효율성만을고려하였기 때문에 사이버보안에 대해서는 취약한 구조를 가지고 있다. 이러한취약점을 이용하여 다양한 사이버 공격이 가능하며 이에 대비하기 위해 CAN 트래픽 분석을 통한 침입탐지 연구가 활발히 추진되어 왔다. 최근에는 탐지성능향상을 위해 다양한 딥러닝모델을 활용한 연구가 진행 중이나 이들 탐지모델은분석 대상 CAN 메시지를 일정 크기의 그룹 단위로 분석하여 해당 그룹에 공격메시지가 존재하는지 여부만을 식별하여 어떤 CAN 메시지가 공격 메시지인지식별하지 못하는 한계점이 있다. 이에 본 논문에서는 트랜스포머 모델을 활용한CAN 침입탐지 모델을 제안한다. 본 탐지모델 적용 시 분석 대상 CAN 메시지중, 공격 메시지 존재뿐만 아니라 시그널 수준에서 공격여부를 식별할 수 있어좀 더 정교한 탐지결과를 제시할 수 있다.
Abstract
CAN is the most widely used network protocol for in-vehicle networks and is used not only for civilian vehicles but also for military ground unmanned systems. However it has a weak structure in terms of cybersecurity because only the reliability and efficiency were considered when CAN was developed. Since various cyberattacks are possible using these vulnerabilities, a lot of researches about intrusion detection through CAN traffic analysis have been actively conducted in order to cope with this problem. Recently, research using various deep learning models is underway to improve detection performance, but these detection models analyze the CAN message in the unit of traffic groups with a certain size and identify only whether an attack message exists in the group, so there is a limitation in that the detection models cannot identify which traffics are related with attacks. In this paper, we propose a CAN intrusion detection model using the Transformer model. By applying this detection model, more precise detection results can be presented because it can identify the attack traffics as well as the existence of attack traffics by analyzing the traffic at the signal level.
참고문헌 (24)
- R. Alur, "Handbook of Networked and Embedded Control Systems" (2005), Birkhauser
- Robert Bosch GmbH, "CAN Specification Version 2.0", ~ (1991)
- Farag, "CANTrack: enhancing automotive CAN bus security using intuitive encryption algorithms", ICMSAO, pp.1~5 (2017)
- Nilsson, "Efficient in-vehicle delayed data authentication based on compound message authentication codes", IEEE 68th vehicular technology conference (2008)
- Hu S, "CVShield: guarding sensor data in connected vehicle with trusted execution environment", ACM workshop on automotive and aerial vehicle security. AutoSec '20 (2020)
- Luo F, "In-vehicle network intrusion detection systems: a systematic survey of deep learning-based approaches", PeerJ Comput. Sci, 9 (2023)
- Kyongtak Cho, "Fingerprinting electronic control units for vehicle intrusion detection", 25th USENIX Conf. Secur. Symp, pp.911~927 (2016)
- K. G. Shin, "Viden: Attacker identification on in-vehicle networks", ACM SIGSAC Conf. Comput. Commun. Secur, pp.1109~1123 (2017)
- W. Choi, "VoltageIDS: Low-level communication characteristics for automotive intrusion detection system", IEEE Trans. Inf. Forensics Security, 13(8), pp.2114~2129 (2018)
- H. M. Song, "Intrusion detection system based on the analysis of time intervals of can messages for in-vehicle network", ICOIN, pp.63~68 (2016)
- A. Taylor, "Frequency-based anomaly detection for the automotive CAN bus", WCICSS, pp.45~49 (2015)
- A. Taylor, "Anomaly detection in automobile control network data with long short-term memory networks", IEEE DSAA, pp.130~139 (2016)
- M.-J. Kang, "A novel intrusion detection method using deep neural network for in-vehicle network security", IEEE 83rd Veh. Technol. Conf, pp.1~5 (2016)
- A. R. Wasicek, "Context-aware intrusion detection in automotive control systems", 5th ESCAR USA Conf, pp.21~22 (2017)
- Javed Ashraf, "Novel Deep Learning-Enabled LSTM Autoencoder Architecture for Discovering Anomalous Events From Intelligent Transportation System", IEEE Transactions on Intelligent Transportation systems, 22(7) (2021)
- E. Seo, "GIDS: GAN based intrusion detection system for in-vehicle network", 16th Annu. Conf. Privacy, Secur. Trust (PST), pp.1~6 (2018)
- Vinayak Tanksale, "Anomaly Detection for Controller Area Networks Using Long Short-Term Memory", IEEE Open Journal of Intelligent Transportatio Systems (2020)
- Hamed, "A deep learning-based intrusion detection system for in-vehicle networks", Computers and Electrical Engineering (2022)
- Verma ME, "the real ORNL automotive dynamometer controller area network intrusion detection dataset (with a comprehensive CAN IDS dataset survey &guide)", arXiv preprint, ~ (2020)
- Markus, "CANet: An Unsupervised Intrusion Detection System for High Dimensional CAN Bus Data", IEEE Access (2020)
- "SynCAN"[URL]
- Shahriar, "Canshield: Singal-based intrusion detection for controller area networks", arXive Preprint ArXive:2205.01306, ~ (2022)
- Ashish Vaswani, "Attention is All you Need", NIPS (2017)
- Gurkirt Singh, "Road: The road event awareness dataset for autonomous driving", IEEE transactions on pattern analysis and machine intelligence, 45(1), pp.1036~1054 (2022)