A Transfer Learning based Abnormal CAN Bus Message Detection System

Electronic control units and actuators in a modern vehicle transmit messages through a controller area network (CAN) bus to ensure driving safety. However, adversaries can easily inject abnormal messages into the CAN bus through an external interface to affect vehicle driving safety. Existing abnormal message detection methods only detect abnormal messages, which are included in their training data and do not consider individual vehicle’s message transmission behaviors, which makes existing methods difficult to detect all abnormal messages accurately and results in their limited application in different vehicles. In this paper, we propose a neural network based abnormal message detection system (NaDS), to detect abnormal messages in the CAN bus. In NaDS, we firstly build a Long Short-Term Memory (LSTM) network to detect both known abnormal messages (included in the training data) and unknown abnormal messages (not included in the training data) in the CAN bus. In the LSTM network, we select message IDs and data field values as network inputs and use a generative adversarial network (GAN) based abnormal message generator to train the LSTM network. We then develop a transfer learning method to transfer a pre-trained LSTM network from one vehicle into a new LSTM network based on a small amount of training data to detect abnormal messages in another vehicle. We use real-vehicle CAN bus message datasets including three different vehicle types to evaluate abnormal message detection accuracy of NaDS. The experimental results demonstrate that NaDS can improve abnormal message detection accuracy by 29% compared with existing methods and keep high abnormal message detection accuracy during network transfer processes.