 |
In general, there are two classes of intrusion detection systems. Rule-based solutions create a set of normal and attack data signatures and normally require expert knowledge to create the database, which must also be constantly updated as new attacks are discovered or as new devices or functionality is added to the vehicle. On the other hand, anomaly-based solutions mathematically model normal behavior and use deviations from it as anomalies. Anomaly-based solutions rely mainly on the availability of data, which possibly makes them more suitable for use in automotive solutions.
Automotive intrusion detection systems use the data related to the message payload, timing information and physical attributes to attack attacks.
In recent years, machine learning-based automotive IDS solutions have been proposed which have explored a plethora of ML algorithms such as neural networks, recurrent neural networks, reconstruction networks, one-class support vector machines and hidden markov models. Random Forest using an ensemble of decision trees has shown very promising results as they are less sensitive to some common machine learning problems such as overfitting and generally performs well in intrusion detection tasks. Performance can sometimes be improved by increasing forest size and complexity, although this comes with an increased computation cost. It may be possible to find the optimum parameters by using a hyperparameter optimization method, such as grid search.
While the explainablity of machine learning-based decisions has been explored in the fields of computer vision and natural language processing, not much work has been done towards explaining decisions made by ML-based intrusion detection systems. In the field of security, Wang et al. proposed a framework to explain why certain decisions are made and what features they use for intrusion detection. In some research work, the explainable AI concept is leveraged to enhance trust management by exploring the decision tree model for intrusion detection. Some recent work focuses on explainable AI to make intrusion detection decisions more interpretable while most of the previous works on model interpretation focuses on other fields like computer vision, natural language processing, and biology. The lack of research in this direction makes it difficult for cybersecurity experts to optimize their decisions according to the judgments of the model in practice.
|
IEEE/ICACT20220035 Slide.05
[Big Slide]
[YouTube]