Domain-Specific Anomaly Detection for In-Vehicle Networks

Connecting components such as electronic control units (ECUs) via an in-vehicle network (IVN) is common in modern vehicles. However, if compromised, the components may send malicious messages to impact the operations of a vehicle and even hurt driving safety. Several in-vehicle intrusion detection system (IDS) solutions based on machine learning have been presented in the literature to detect unknown attacks. Such IDSs are deployed on a central gateway or within each ECU. We note that some vehicles have implemented domain gateways/controllers and automotive Ethernet to support the increasing bandwidth and complexity of the IVN. The domain gateways can take over the computation load from the ECUs. Therefore, each domain gateway can be a promising place to implement an IDS to detect and block malicious messages in its domain. We can optimize the domain-specific IDS model to classify malicious or normal messages in each domain and make it lightweight. In this work, we present two models of lightweight unsupervised IDS solutions for the domain gateway model. Our designs have only 2,708 and 49,454 parameters, fewer than the state-of-the-art designs. Their training and testing time are also shorter, achieving high accuracy from 0.90 to 1.00 in detecting the malicious messages on each domain gateway.