Anomaly Detection for Controller Area Network

• Activity Number: 336 - Statistical Modeling and Machine Learning for National Security Applications
• Type: Contributed
• Date/Time: Tuesday, August 9, 2022 : 2:00 PM to 3:50 PM
• Sponsor: Section on Statistics in Defense and National Security
• Author(s): Kelly Toppin* and Frederica Nelson and Nandi Leslie
• Companies: ICF / US Army ARL and US Army ARL and Raytheon/ US Army ARL
• Keywords: statistical ensemble models; hierarchical agglomerative clustering; in-vehicle networks; machine learning; controller area network ; data stream

Abstract

Motor vehicles rely on numerous on-board electronic control units (ECU) to govern important vehicle functions. Most of the data essential to the operation of these ECUs use the controller area network(CAN) bus for the communication between ECUs. Any malicious manipulation of the data can result in dire consequences. Thus detecting anomalous data on the CAN bus is of upmost importance for safe vehicle operations. Ensemble models are often used to capture the strengths of several anomaly detectors, but selecting and combining these detectors are often difficult tasks. Furthermore, the dynamics of continuous data stream on the CAN increases the difficulty in the intra-vehicle environment. In 2021, Leslie [1] presented that an unsupervised ensemble hierarchical agglomerative clustering (E-HAC) model based on majority voting across predictions from 10 hierarchical agglomerative clustering algorithms produced encouraging results. In this paper we extend the performance of this E-HAC ensemble model by dynamically assigning weight to the contributions of each base detector using the statistical characteristics of each new instances in the CAN data stream.