CANnolo: An Anomaly Detection System Based on LSTM Autoencoders for Controller Area Network

Automotive security has gained significant traction in the last decade thanks to development of new connectivity features that have brought vehicle from an isolated environment externally facing domain. Researchers shown modern vehicles are vulnerable multiple types attacks leveraging remote, direct and indirect physical access, which allow attackers gain control affect safety-critical systems. Conversely, Intrusion Detection Systems (IDSs) been proposed by both industry academia identify anomalous behaviours. In this article, we propose CANnolo, IDS based on Long Short-Term Memory (LSTM)-autoencoders anomalies Controller Area Networks (CANs). During a training phase, CANnolo automatically analyzes CAN streams builds model legitimate data sequences. Then, it detects computing difference between reconstructed respective real We experimentally evaluated set simulated applied over real-world dataset. show our approach outperforms state-of-the-art improving detection rate precision.