SDN-Based False Data Detection With Its Mitigation and Machine Learning Robustness for In-Vehicle Networks

TL;DR

This paper introduces an SDN-based system utilizing LSTM and re-training techniques to detect and mitigate false data injection attacks in in-vehicle CAN networks, enhancing security for autonomous vehicles.

Contribution

It presents a novel real-time false data detection and mitigation system using SDN and LSTM, with robustness against various adversarial attacks in in-vehicle networks.

Findings

FDDMS effectively detects false data injection attacks in real-time.

The system demonstrates robustness against multiple adversarial attack methods.

Dynamic flow rule updates mitigate attack impacts successfully.

Abstract

As the development of autonomous and connected vehicles advances, the complexity of modern vehicles increases, with numerous Electronic Control Units (ECUs) integrated into the system. In an in-vehicle network, these ECUs communicate with one another using an standard protocol called Controller Area Network (CAN). Securing communication among ECUs plays a vital role in maintaining the safety and security of the vehicle. This paper proposes a robust SDN-based False Data Detection and Mitigation System (FDDMS) for in-vehicle networks. Leveraging the unique capabilities of Software-Defined Networking (SDN), FDDMS is designed to monitor and detect false data injection attacks in real-time. Specifically, we focus on brake-related ECUs within an SDN-enabled in-vehicle network. First, we decode raw CAN data to create an attack model that illustrates how false data can be injected into the system. Then, FDDMS, incorporating a Long Short Term Memory (LSTM)-based detection model, is used to identify false data injection attacks. We further propose an effective variant of DeepFool attack to evaluate the model's robustness. To countermeasure the impacts of four adversarial attacks including Fast gradient descent method, Basic iterative method, DeepFool, and the DeepFool variant, we further enhance a re-training technique method with a threshold based selection strategy. Finally, a mitigation scheme is implemented to redirect attack traffic by dynamically updating flow rules through SDN. Our experimental results show that the proposed FDDMS is robust against adversarial attacks and effectively detects and mitigates false data injection attacks in real-time.