Intrusion Detection System Based on Deep Neural Network and Incremental Learning for In-Vehicle CAN Networks

With the application of information technology in automotive electronic system and the development of internet of vehicles, automobiles face increasing security threats. Controller area network (CAN) is the main bus system for communication between electronic control units (ECUs) in modern automobiles. CAN bus network easily suffers from cyberattacks because it lacks security protection mechanisms. Intrusion detection is an effective method to defend a network against attacks. However, the detection accuracy may be affected by the change in driving environment or driving behavior and the occurrence of unknown attacks. A two-stage intrusion detection method based on Deep Neural Network (DNN) and Incremental Learning (IL) is proposed to improve detection performance. In an offline training stage, DNN is applied to obtain basic classification model using marked actual CAN data. Then, in the online detection and updating stage, the model is updated with IL technology based on new unlabeled data, at the same time performing intrusion detection. Experimental results show that the proposed method has high detection accuracy and good generalization ability.