Here comes SAID: A SOME/IP Attention-based mechanism for Intrusion Detection.

The increasing connectivity among vehicles along with their rising complexity increases their attack surface and challenges their security. In this paper, we consider the problem of intrusion detection for SOME/IP protocol and present “SAID” a novel technique for the detection of anomalies from a large sequence of exchanged SOME/IP network packets. The proposed detector leverages a self-attention-based neural network to model the contextual dependencies between SOME/IP packets. For this purpose, we evaluate our proposed approach, by generating a simulated and manually annotated SOME/IP dataset, with several categories of attacks. The results of the extensive experiments indicate that our technique detects (with high accuracy) the majority of SOME/IP’s protocol violations, e.g., with an area-under-the-curve $\approx 0.8$, and inference time $\approx 0.3$ ms. A comparative study, including various state-of-the-art benchmark algorithms, shows that SAID shows better performance in detecting intrusions and enables parallelization. Our source code and data are available at: https://github.com/Alkhatibnatasha/supervised_detection_some_ip/