A Cluster-Based Multidimensional Approach for Detecting Attacks on Connected Vehicles

Nowadays, modern vehicles are becoming even more connected, intelligent, and smart. A modern vehicle encloses several cyber–physical systems, such as actuators and sensors, which are controlled by electronic control units (ECUs). Such ECUs are connected through in-vehicle networks, and, in turn, such networks are connected to the Internet of Vehicles (IoV) to provide advanced and smart features. However, the increase in vehicle connectivity and computerization, although it brings clear advantages, it introduces serious safety problems that can also endanger the life of the driver and passengers of the vehicle, as well as that of pedestrians. Such problems are mainly caused by the security weaknesses affecting the controller area network (CAN) bus, used to exchange data between ECUs. In this article, we provide two algorithms that implement a data-driven anomaly detection system. The first algorithm (cluster-based learning algorithm), is used to learn the behavior of messages passing on the CAN bus, for base-lining purposes, while the second one (data-driven anomaly detection algorithm) is used to perform real-time classification of such messages (licit or illicit) for early alerting in the presence of malicious usages. The experimental results, obtained by using data coming from a real vehicle, have shown that our approach is capable of performing better than other anomaly detection-based approaches.