HAVEN: A Hybrid Anomaly Detection System for Intra-Vehicular CAN-Bus Communication Using Rule-Based and Neural Networks

Modern vehicles rely on ECUs connected over an Intra-Vehicular CAN-bus network to facilitate data exchange. However, in recent times, the quantity of potential attack surfaces for malicious cyberattacks, such as DOS, Fuzzy, etc., has notably surged owing to their amplified connectivity. Unfortunately, the CAN bus solitarily cannot ensure its protection due to its deficiency in security components, leading to grave safety and security issues like disabling the brakes, etc., and hence requires a reliable mechanism for detecting anomalies in the system. To address these challenges, this paper proposes HAVEN, a Hybrid Anomaly Detection System for Intra-Vehicular CAN-bus Communication using combinations of Rule-based with Machine Learning techniques and Neural Networks (Binary and Multiclass Classification forms). The experimental results show that our proposed hybrid models achieve high detection accuracy on different datasets incurring significantly low execution time and high F1-score. This is attributable to the parallel execution and multi-threading nature of the Machine Learning and Neural Networks employed in conjunction with the Rule-based techniques. Upon comparing the results of both models, our evaluation demonstrates that the second model incorporating neural networks yields superior results, establishing its potential as a highly efficient and promising solution and opening future avenues for further research work.