 |
The proposed intrusion detection model has three main parts. The data pre-processing part uses a data aggregation technique based on a specific window size to extract a set of time and frequency-based features from the CAN bus data. To aid in the feature exploration, the feature sets are organized as different sizes of feature sets where a univariate feature selection mechanism is followed. This generates selected and ranked features with tailored intervals dividing the total number of features into four sections. The univariate feature selection expedites the selection of the most important features based on univariate statistical tests. As a result, the univariate feature selection enables strong statistical tests that can be used to select those features that are most important and have the strongest relationship with the output variable. The model exploration is done through setting up three control models and evaluating the final model¡¯s decision based on the contribution of each of the three control models. The contributions from each control model are represented in the form of a vote to the final model. This supports the training of the binary classification problem with m number of models. And finally, the model testing is performed which outputs the result as either an attack instance or normal instance.
|
IEEE/ICACT20220035 Slide.06
[Big Slide]
[YouTube]