Transfer Learning-Based Intrusion Detection System for a Controller Area Network

The Controller Area Network (CAN) is a major protocol for in-vehicle network communications. This protocol is simple and efficient for message transmission and the smooth functioning of an in-vehicle system. On the other hand, the weaknesses of this protocol, such as the ID-based arbitration method for message transmission and lack of authentication mechanism, make it vulnerable to various security attacks, including DoS attacks, Fuzzy attacks, impersonation attacks, and replay attacks. Since there is no authentication mechanism for transmitted messages, we need a way to distinguish between normal and attack messages. An intrusion detection system (IDS) is an option for this problem because it can raise alarms when there are flaws in the system. IDS is very efficient for intrusion detection where messages with the same IDs are transmitted periodically. The deviation from the normal pattern of message transmission will force the IDS system to trigger alarms. Most studies on the CAN bus IDS system were based on a supervised learning approach. On the other hand, the lack of labeled datasets and a huge amount of training time make it inefficient for new attack patterns. This paper proposes a transfer learning-based IDS system for in-vehicle network intrusion detection. The extraction of quality features using transfer learning (TL) and appropriate fine-tuning methodology is used in the proposed model. This approach can use the available intrusion attack dataset to detect new attacks. The experimental results indicated that the proposed deep hybrid transfer learning (TL) model detects new threats with a high accuracy of approximately 99.9% when compared to state-of-the-art methods, while also lowering training and testing time by more than 30%.