An Anomaly Detection Method based on Multiple LSTM-Autoencoder Models for In-vehicle Network

The CAN protocol is widely adopted for in-vehicle networks due to its cost efficiency and reliable transmission. However, despite its popularity, the protocol lacks built-in security mechanisms, making it vulnerable to various attacks such as flooding, fuzzing, and DoS. These attacks can exploit vulnerabilities and disrupt the normal behavior of the in-vehicle network. One of the main reasons for these security concerns is that the protocol relies on broadcast frames for communication between ECUs within the network. To tackle this issue, this paper presents an intrusion detection system that leverages multiple LSTM-Autoencoders. The proposed system utilizes diverse features, including transmission interval and payload value changes, to capture various characteristics of normal network behavior. By analyzing different types of features separately using the LSTM-Autoencoder model, the system effectively detects anomalies. In our evaluation, we conducted experiments using real vehicle network traffic, and the results demonstrated the system's high precision with a 99% detection rate in identifying anomalies.