Enhanced Intrusion Detection System for Controller Area Network (CAN) Using Meta-Heuristic Optimization

In the past, automobiles operated solely on mechanical systems; however, moder vehicles incorporate numerous embedded electronic systems referred to as Electronic Control Unit (ECU). ECUs control a wide range of functions, from critical operations like airbags and electronic braking systems to comfort applications like automatic windows. Additionally, ECUs communicate with each other through in-vehicle communication networks, informing the driver via the instrument panel and ensuring a safer and more comfortable driving experience. The most prevalent in-vehicle communication protocol is the Controller Area Network (CAN) protocol. Reasons for its widespread use in the automotive industry include its low cost, resistance to electromagnetic interference, common network topology prioritizing real-time systems, and easy maintenance. However, despite being the most commonly used communication protocol, CAN faces various security issues due to the lack of encryption and authentication. As a result, any malicious or compromised ECU could lead to catastrophic accidents and financial losses. Most existing intrusion detection systems (IDSs) have the capability to detect known and often only one type of cyber-attack. IDSs that can detect different types of cyber-attacks do not operate in real-time due to high resource usage. This study aims to develop an IDS tailored for the CAN network, leveraging machine learning techniques optimized with meta-heuristic algorithms to ensure efficient resource utilization and fast detection times, crucial for real-time operation. Moreover, an extensive dataset encompassing diverse cyber-attack scenarios will be created from a CAN bus testbed to rigorously evaluate the efficacy of the proposed system. This dataset will subsequently be disseminated for wider research utilization. Unlike existing datasets in the literature, which are limited in number and suffer from deficiencies such as limited cyber-attack types and insufficient sample sizes, the dataset generated in this study promises to address these gaps, enhancing the quality and breadth of available resources for researchers. Additionally, this study will provide the necessary software infrastructure for meta-heuristic and machine learning initiatives in the development of IDSs, thus delivering a valuable resource for researchers in this domain.