Anomaly Detection for In-Vehicle Network Using Self-Supervised Learning With Vehicle-Cloud Collaboration Update

With the increasing communications between the In-Vehicle Networks (IVNs) and external networks, security has become a stringent problem. In addition, the controller area network bus in IVN lacks security mechanisms by design, which is vulnerable to various attacks. Thus, it is important to detect IVN anomalies for complete vehicular security. However, current studies are constrained by either requiring labeled data or failing to accurately detect message-level anomalies without labeled data. In addition, the concept drift of existing methods has become a challenge over time. To address these problems, this paper proposes an IVN anomaly detection method based on Self-supervised Learning (IVNSL), which is capable of detecting message-level anomalies without labels. The essential idea of IVNSL is to make the message prediction model learn the distribution of normal messages in sequences using message sequences with noise. Furthermore, to accurately detect anomalies, a Message Prediction Model based on Hierarchical transformers (MPMHit) is proposed, which captures the spatial features of the message and the dependencies between messages. Meanwhile, to solve the concept drift over time, this paper proposes an online update mechanism for MPMHit based on vehicle-cloud collaboration. We conduct an extensive experimental evaluation on the car hacking dataset, resulting to an F1-score average and average false positive rates of IVNSL being 2.282% higher and 1.595% lower than the best baseline method. The average detection speed of each message is as fast as 0.1075 ms.