Federated Learning-Based Intrusion Detection System for In-Vehicle Network Using Statistics of Controller Area Network Messages

Intelligent Transportation System (ITS) is developing at a fast pace, bringing advanced technologies to cars and traffic infrastructures. By embracing the Vehicle-to-Everything (V2X), vehicles become more connected while exposing themselves to more attack surfaces and cyberattacks. To protect drivers’ security, many academics are making efforts to implement anomaly detection systems on individual vehicles, which mainly use CAN IDentifiers (ID) or the raw Controller Area Network (CAN) messages as the input to the anomaly detection systems. In this paper, we propose a novel Federated Learning (FL)-based Intrusion Detection System (IDS) leveraging the CAN messages. Compared to existing works, our work exploits the timing and the byte-level data features of CAN messages in the FL-based IDS to enhance the performance of identifying malicious messages of potential cyberattacks. The proposed FL-based IDS transforms raw CAN messages into high-dimensional data statistics, i.e., CAN ID, time difference, and byte change rate, through data abstraction and feeds the extracted statistics into the FL processing. Our work also considers the real on-road scenarios for the FL-based IDS to tackle the challenges related to connection losses during the FL training and aggregation phases. Experimental results validate that the proposed system performs better, with an accuracy of \(71.14\%\) , a precision of \(77.12\%\) , a recall of \(80.90\%\) and an \(F_1\) Score of \(78.96\%\) - when cooperating with 15 cars in the FL network rather than using a single car.