Anomaly Detection of Cyber Physical Network Data Using 2D Images

Vehicles are increasingly cyber-physical systems which depend on upwards of 100 or more networked control units. Consequently vehicles, especially those produced after about 2010, face challenges to ensure autonomy, security, and safety. The vehicles' electronic control units (ECUs) control most of the safety-critical systems. Protecting these networks is especially challenging because there is no publicly available translation of in-vehicle network data to vehicle functions. Thus, an intrusion detection system (IDS) based on mapping the controller area network (CAN) data to 2D images has been developed. While somewhat similar to other recent works that map network features to images, this novel approach utilizes the underlying physical model to automatically group features in a method that makes convolutional neural network (CNN) analysis more feasible. It addresses the most challenging attack in which a compromised ECU sends out incorrect values but sends them within the correct time window. This novel method is shown to detect these kinds of rogue ECU cyber-attacks with greater than a 90% accuracy using very limited training data.