Anomaly Detection for In-Vehicle Communication Using Transformers

Abstract

With the advancements of modern vehicle infrastructures, vehicles are increasingly relying on the signals received from a vast number of sensors and electronic components. Wireless technologies enable communication between vehicles and infrastructure, but it also increase the vulnerability surface. Malicious actors can remotely disrupt the vehicle's normal behavior, causing vehicle damage or worse, putting human lives in danger. To address these challenges, this paper proposes a transformer neural network-based intrusion detection system (CAN-Former IDS) that predicts anomalous behavior within the CAN protocol communication. Previous work typically addresses the prediction over the sequence of the CAN IDs. In this paper, we will simultaneously analyze both the sequence of IDs and the message payload values. The advantages of our approach are: 1) fully self-supervised training, which does not require labeled data, 2) self learning interactions between input tokens without relying on hand-crafted features. The transformer neural network is trained to predict the next communication sequence and anomalous communication is identified by comparing the real sequence to the predicted expected sequence. We evaluated our approach using a publicly available data set known as survival analysis data set, containing CAN communication from three different cars.