Machine Learning with Real-time and Small Footprint Anomaly Detection System for In-Vehicle Gateway - arXiv 2406.16369v1 - Abstract

Aug 4, 2026

Upload by Rowan

Anomaly Detection System (ADS) is critical for a vehicle gateway ECU to identify abnormal behaviors and cyberattacks under tight real-time constraints and very limited code footprint. “One-time” attacks are especially difficult because they manipulate CAN payload content only once while remaining within valid ranges. The proposed solution uses self-information theory with logarithm-based value generation to enable real-time unsupervised detection without anomaly labels. Comparisons with HMM, SVDD, and LSTM show 8.7× lower FPR, 1.77× faster testing, and 4.88× smaller footprint.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages5

Reading Time13 min

AccessFree to download

Introduction

Background: in-vehicle networks and CAN limitations

Threats and the challenge of “one-time” attacks

Existing ML and non-ML approaches

Proposed approach and objectives

Machine Learning with Real-time and Small Footprint Anomaly Detection System for In-Vehicle Gateway arXiv :2406 . 16369v1 [ cs .CR] 24 Jun 2024 Yi Wang Product Cybersecurity & Privacy Of􀀂ce Continental Automotive Singapore Singapore [estelle.wang@continental.com](estelle.wang@continental.com) Yuanjin Zheng School of EEE Nanyang Technological University Singapore [YJZHENG@ntu.edu.sg](YJZHENG@ntu.edu.sg) Yajun Ha School of Information Science and Technology ShanghaiTech University Shanghai, China [hayj@shanghaitech.edu.cn](hayj@shanghaitech.edu.cn) Abstract—Anomaly Detection System (ADS) is an essential part of a modern gateway Electronic Control Unit (ECU) to detect abnormal behaviors and attacks in vehicles. Among the existing attacks,“one-time” attack is the most challenging to be detected, together with the strict gateway ECU constraints of both microsecond or even nanosecond level real-time budget and limited footprint of code. To address the challenges, we propose to use the self-information theory to generate values for training and testing models, aiming to achieve real-time detection performance for the “one-time” attack that has not been well studied in the past. Second, the generation of self-information is based on logarithm calculation, which leads to the smallest footprint to reduce the cost in Gateway. Finally, our proposed method uses an unsupervised model without the need of training data for anomalies or attacks. We have compared different machine learning methods ranging from typical machine learning models to deep learning models, e.g., Hidden Markov Model (HMM), Support Vector Data Description (SVDD), and Long Short Term Memory (LSTM). Experimental results show that our proposed method achieves 8.7 times lower False Positive Rate (FPR), 1.77 times faster testing time, and 4.88 times smaller footprint. Index Terms—ADS, Machine Learning, Gateway I. INTRODUCTION With the emerging requirement of the Arti􀀂cial Intelligence of Things (AIoT) in vehicular applications, consumers pay more and more attention to personal privacy and con􀀂dentiality, apart from the safety, compatibility, and performance of a modern vehicle [1] . The in-vehicle network consists of Electronic Control Units (ECUs) to construct various subsystems. In contrast with the point to point connections, several peripherals have been connected using the same set of wires, enabling different controllers to share the same signals of a single sensor. However, the basic protocol of the in-vehicle network, Controller Area Network (CAN) [2], only provides the address dependability and fault detection. There are existing security threads and holes to be used by the attackers to retrieve sensitive information of the critical components, such as the engine ECU, the brake ECU, etc. [3] [4] . These lead to possible security vulnerabilities, e.g., spoofing, manipulation, man-in-the-middle attacks. These attacks can be successful when the adversaries compromise the pri- mary interfaces and the gateway system. For instance, Miller and Valasek [5] have successfully penetrated the wireless interfaces of the entertainment system in the Jeep Cherokee and took over the central controller of the car. This attack can cause a severe safety concern with a million of losses, which affects all the stakeholders, such as OEMs and automotive tierone suppliers. There are also existing typical attacks of CAN bus in-vehicle networks, which are message 􀀃ooding, cyclic message, replay, and “one-time” attacks. Among them,“onetime” attack is the most challenging and dif􀀂cult to be detected by Anomaly Detection System (ADS) . This type of attack only manipulates the data payload or the content once using one malicious CAN message (the data payload or content is still within the valid data range after hacking) . This kind of attack could be severe for the CAN bus message with sensitive information to critical ECUs, e.g., braking control, air-bag control,

FAQs

Why are “one-time” attacks hard to detect with an in-vehicle ADS?

They modify the CAN payload or content only once using a malicious message while the manipulated data still stays within the valid range, making traditional detection difficult.

What key constraint motivates the proposed small-footprint design?

The gateway ECU requires extremely fast real-time detection budgets (microsecond or even nanosecond level) and limited available space for additional code.

How does the method avoid the need for labeled anomaly datasets?

It employs an unsupervised machine learning approach based on self-information theory to generate training/testing values without requiring labeled anomalies or attacks.

Aug 4, 2026

Upload by Rowan