Anomaly Detection for Controller Area Network in Braking Control System With Dynamic Ensemble Selection

The controller area networks (CAN) in the braking control system of metro trains are used to transmit the important control instruction and condition information, whose anomaly will endanger the security of trains running seriously. Due to the harsh work environment, there are various known and previously unknown fault types, current scheduled maintenance cannot detect early anomaly in time, and constructing an accurate and stable anomaly detector is a challenging task. In this paper, an anomaly detection approach is proposed to detect anomaly based on a dynamic ensemble selection system (DESS) without the expert knowledge, which involves two-class and one-class classifiers, and the base classifiers are trained with the network features extracted from the physical-layer information. To conduct the fusion, the support function of “distance-based” classifier is redefined as a class-conditional probability density function, and the source competence of base classifier is estimated by the entropy-based method in validate space and extended to entire decision space using the normalized Gaussian potential function. For different fault types, the competence classifiers are selected and the anomaly detection result is finally achieved by weighted majority voting. The comparative experiments are included in this paper to demonstrate the effectiveness and robustness in anomaly detection, including varying fault types.