Detection of cybersecurity spoofing attacks in vehicular networks with recurrence quantification analysis

Cybersecurity aspects in modern automotive vehicles are becoming increasingly important due to the recent demonstration of successful cybersecurity attacks to vehicles. The improved connectivity and complexity of modern and future vehicles can increase the risk of attacks implemented in the in-vehicle network. Time efficiency and the accuracy in the detection of the attack are usually the key indicators on the performance of the approach. This paper proposes a novel approach based on the application of Recurrence quantification analysis (RQA) in combination with a sliding window approach, which is based on the analysis of the CAN-bus message arrival time. As a consequence, this proposed approach does not require the processing of the arbitration field or the payload data of the CAN-bus message, which may require more computing time. The rationale for the application of RQA is to consider the in-vehicle network as a dynamic system where the CAN-bus message time is used as an observable. The approach is evaluated with machine learning algorithms on two public data sets recently published by the research community specifically for spoofing attacks since they are the most difficult to detect. The proposed approach is compared with the application of entropy measures for attack detection as commonly adopted in literature. The results show that the application of RQA improves significantly the detection accuracy of the spoofing attack in a consistent way across different sliding windows size in both data sets. This paper provides also an extensive evaluation of the impact of the sliding window size and the hyper-parameters present in the definition of RQA and the machine learning algorithms.

BALDINI Gianmarco; 

2023-09-27

ELSEVIER

JRC126502

0140-3664 (online),   

https://www.sciencedirect.com/science/article/pii/S0140366422001736,    https://publications.jrc.ec.europa.eu/repository/handle/JRC126502,   

10.1016/j.comcom.2022.05.021 (online),