Real-Time Zero-Day Intrusion Detection System for Automotive Controller
  Area Network on FPGAs
Shashwat Khandelwal Shreejith Shanker
Increasing automation in vehicles enabled by increased connectivity to the
outside world has exposed vulnerabilities in previously siloed automotive
networks like controller area networks (CAN). Attributes of CAN such as
broadcast-based communication among electronic control units (ECUs) that
lowered deployment costs are now being exploited to carry out active injection
attacks like denial of service (DoS), fuzzing, and spoofing attacks. Research
literature has proposed multiple supervised machine learning models deployed as
Intrusion detection systems (IDSs) to detect such malicious activity; however,
these are largely limited to identifying previously known attack vectors. With
the ever-increasing complexity of active injection attacks, detecting zero-day
(novel) attacks in these networks in real-time (to prevent propagation) becomes
a problem of particular interest. This paper presents an
unsupervised-learning-based convolutional autoencoder architecture for
detecting zero-day attacks, which is trained only on benign (attack-free) CAN
messages. We quantise the model using Vitis-AI tools from AMD/Xilinx targeting
a resource-constrained Zynq Ultrascale platform as our IDS-ECU system for
integration. The proposed model successfully achieves equal or higher
classification accuracy (> 99.5%) on unseen DoS, fuzzing, and spoofing attacks
from a publicly available attack dataset when compared to the state-of-the-art
unsupervised learning-based IDSs. Additionally, by cleverly overlapping IDS
operation on a window of CAN messages with the reception, the model is able to
meet line-rate detection (0.43 ms per window) of high-speed CAN, which when
coupled with the low energy consumption per inference, makes this architecture
ideally suited for detecting zero-day attacks on critical CAN networks.