Behavioral Residualization for Unsupervised Intrusion Detection in Automotive CAN Networks
Chandan Hegde, Mukundh R Reddy, Dr Kumaresh Sheelavant
Modern vehicles exchange safety-critical messages over the Controller Area Network (CAN), a bus designed for low cost and real-time operation that offers neither authentication nor encryption. Once an attacker reaches the network, arbitrary frames can be injected. Existing detectors frequently rely on surface cues (previously unseen identifiers, constant payload bytes, or irregular DLC values). These cues yield near-perfect scores on public corpora whose attacks are separable by exactly those rules, yet they collapse when the adversary simply reuses legitimate identifiers. We introduce per-ID behavioral residualization (PIRD). Fourteen temporal, protocol and payload statistics are extracted from sliding windows belonging to each arbitration ID and then expressed as standardized residuals relative to that ID's own benign baseline. When the resulting residual vectors are supplied to six standard unsupervised detectors, mean F1 rises in the majority of experimental cells (21 of 24 on HCRL, 30 of 36 on ROAD, five random seeds). On targeted legitimate-ID attacks the method attains recall >= 0.99 and ROC-AUC near 0.99. A deployment-oriented Phase-1 protocol (cross-condition transfer, global threshold, alternative residualization strategies, window/latency sweep) additionally reports Recall at fixed FPR, FPR at target recall, false alarms per hour and detection latency. Two clear failure modes, novel-ID flooding (HCRL DoS, F1 = 0.02) and cross-ID fuzzing (ROAD, F1 = 0.27), are quantified and left as open problems.
尚无 AI 解读，展示原文摘要