Open World Intrusion Detection: An Open Set Recognition Method for Can Bus in Intelligent Connected Vehicles

The Controller Area Network (CAN) is a bus protocol widely used in intelligent connected vehicles for communication between electronic and electronic systems. However, the continuous increase in inter- and intra-vehicle communication traffic makes the CAN bus vulnerable to cyber-attacks, including unknown attacks that have never been seen before. Previous studies either use closed set scenarios to misclassify unknown attacks as known classes with high confidence, or use closed set models to calculate thresholds to identify unknown attacks ignoring the relationship between feature representation and thresholds. To handle this challenge, we formulate the problem as an open set recognition problem to accurately detect K known classes and identify 1 unknown class. Following this, we propose CLUSTER for CAN bus intrusion detection. CLUSTER utilizes the distance from known class inputs to cluster centroids as the training loss to be consistent with the threshold for open set recognition. Then it learns feature representations for intra-class compactness and inter-class separation, thereby classifying fine-grained known classes and identifying unknown attacks. Extensive experimental results on the car-hacking dataset demonstrate that the proposed open set recognition model is significantly superior to existing methods. In addition, due to the different operating environments of intelligent connected vehicles, intelligent connected vehicles will encounter different unknown attacks that have not been seen by each other. In order to share attack knowledge about unknown attacks among intelligent connected vehicles to protect them from intrusions, we propose an open world vehicle-cloud collaborative intrusion detection framework.