Anomaly Detection for Controller Area Networks Using Long Short-Term Memory

The rapid expansion of intra-vehicle networks has increased the number of threats to such networks. Most modern vehicles implement various physical and data-link layer technologies. Vehicles are becoming increasingly autonomous and connected. Controller Area Network (CAN) is one such serial bus system that is used to connect sensors and controllers (Electronic Control Units-ECUs) within a vehicle. ECUs vary widely in processing power, storage, memory, and connectivity. Classical cryptographic approaches are resource intensive. There is a need for efficient security countermeasures for protecting the CAN from various attacks. In this article, we present a novel Long Short-Term Memory (LSTM) network to detect anomalies. Once trained, our system is capable of detecting anomalies in real-time and uses minimal resources. We report the results of our novel prediction algorithm that we use to select optimal LSTM network parameters. Our prediction algorithm and anomaly detection engine have been tested on data from real automobiles. We present the results of our experiments and analyze our findings.