MKF-ADS: Multi-Knowledge Fusion Based Anomaly Detection System in Vehicular Control Area Networks

As the standard communication protocol for vehicular networks, the Controller Area Network (CAN) plays a crucial role in coordinating interactions among Electronic Control Units (ECUs). However, intruders can launch malicious attacks on the CAN due to the lack of security mechanisms. Intrusion Detection Systems (IDSs), as a defense component, are deployed to monitor the CAN and detect suspicious behavior resulting from an attack. Existing IDSs have high false alarms in complex attacks due to limited feature modeling capabilities. In this paper, we propose a multi-knowledge fusion-based anomaly detection system, called MKF-ADS. Specifically, the method designs a prediction-based framework that integrates a spatial-temporal correlation module with an attention mechanism (STcAM) and a patch-based sparse transformer (PatchST) module. The fine-pruned STcAM applies one-dimensional convolution (Conv1D) to extract spatial features and subsequently employs the Bidirectional Long Short Term Memory (Bi-LSTM) to capture temporal features, with an attention mechanism that focuses on important time steps. Meanwhile, the PatchST captures contextual features from independent univariate time series. Finally, the proposed model uses STcAM as a student model to learn intrinsic knowledge and cross-imitate PatchST's competencies through knowledge distillation. Extensive evaluations demonstrate that MKF-ADS is lightweight and effectively performs anomaly prediction and detection across six attack scenarios. Compared to the baseline, the proposed method is more robust, achieving a high F1-score while maintaining controllable false alarms.