Listening to CAN: Anomaly Detection to Enhance In-Vehicle Network Security

The Controller Area Network (CAN) protocol is widely used today due to its excellent reliability, flexibility, and low cost. However, the intrusion detection system (IDS) for CAN has become an important issue because the CAN protocol is vulnerable to attacks. Conventional IDS research detects only trained attacks, since they exploit supervised learning. Some studies exploit 2-D unsupervised IDS based on Generative Adversarial Nets (GAN) to detect untrained or new types of attacks, but they suffer from performance degradation because CAN attack data are I-D in the time axis. We propose a novel 1- D unsupervised IDS which converts normal data without any attacks into waveforms and subsequently is trained with WaveGAN. The proposed method effectively detects untrained attacks since it exploits unsupervised learning. Also, it shows better performance compared to the conventional unsupervised IDS using 2-D GAN since it exploits I-D WaveGAN.