Auto-CIDS: An Autonomous Intrusion Detection System for Vehicular Networks

Control Area Network (CAN), despite facilitating electronic control unit (ECU) communications, lacks built-in mechanisms for secure transmission, exposing its messages to cyber-attacks due to unsecured broadcasting. Current Intrusion Detection Systems (IDSs) for CAN rely predominantly on rule-based, statistical, or supervised machine learning (ML) models, which require significant human intervention for tasks such as reconfiguration, gathering labeled data samples, and retraining with newly released vehicle models. These manual dependencies highlight the critical need for autonomous capability in IDS that can adapt independently, thus mitigating practical deployment challenges in real-world scenarios. In this paper, we propose an autonomous cybersecurity IDS named Auto-CIDS, designed to minimize human intervention and enable active learning utilizing past experiences. By applying Deep Reinforcement Learning (DRL) with the advantages of unsupervised algorithms, we train Deep Q-network (DQN) agents in a self-supervised manner using their own past experiences. We develop three standalone autonomous methods. The first method, Single-Task Self-Supervised, uses an autoencoder to supervise DQN agents in each environment, which includes both normal and specific attack data without needing labeled datasets. The second method, Multi-Environment Self-Supervised, enhances the generalization ability of the first by training a DQN agent across multiple environments, allowing knowledge transfer from varied settings into a single agent. The third method, Multi-Task Multi-Agent, increases the robustness of our proposed Auto-CIDS by employing a combination of modified unsupervised methods, including autoencoder, k-means, and isolation forest algorithms, each tailored for a specific type of attack. This approach builds attack-specific DQNs that periodically and cooperatively train a global DQN agent based on their predictions, facilitating ongoing active learning. We conducted experiments on the Car-Hacking dataset, which includes Denial of Service (DoS), fuzzy, and spoofing attacks, and the results demonstrate the effectiveness of these methods in detecting cyber-attacks. The results also demonstrate high evaluation metrics, including False Negative Rate (FNR), Error Rate (ER), accuracy, recall, precision, and F1 score. Additionally, these methods significantly reduce the need for human intervention by enhancing the autonomy of our proposed IDS. This increased autonomy enables the systems to adapt to new environments, thereby making our Auto-CIDS more autonomous and adaptable.

Fetched live from OpenAlex and de-inverted. Abstracts are not stored in this database: the inverted indexes are 8.6 GB of the frame’s 9.3 GB of text, and the host has 13 GB free.