Comparative Analysis of Cosine and Jaccard Similarity-Based Classification for Detecting CAN Bus Attacks

Connected vehicles have recently obtained significant attention for their potential to revolutionize the transportation industry. While this increased connectivity offers numerous benefits, it also expands the attack surface by introducing more physical access points. Specifically, the abnormal behavior of Electronic Control Units (ECUs) induced by attacks can result in severe implications, including potentially lethal accidents. Thus, it is essential to develop techniques that can monitor vehicular data and find anomalies for subsequent threat evaluation. As attacks targeting the CAN bus have increased, researchers have investigated intrusion detection systems (IDSs) to identify threats against the CAN bus. In this paper, we employ the Jaccard and cosine similarity scores to classify CAN bus data as normal or attack. We have considered four attack scenarios: DoS, fuzzy, replay, and spoofing collected from real vehicle. We have also utilized three publicly available datasets. The similarity score range and CAN ID act as features for the classification task, and logistic regression is applied to obtain the results. The proposed approach demonstrates the effectiveness of utilizing similarity measure and machine learning technique for detecting intrusions in CAN bus networks by achieving significant results in the detection task.