MKF-ADS：基于多知识融合的控制器局域网自监督异常检测系统
MKF-ADS: Multi-Knowledge Fusion Based Self-supervised Anomaly Detection System for Control Area Network
AI总结：
提出MKF-ADS，一种基于多知识融合的自监督异常检测系统，结合时空注意力与补丁稀疏变换器，通过知识蒸馏提升CAN入侵检测性能，显著降低误报率。
摘要：
控制器局域网（CAN）是车载网络中电子控制单元（ECU）之间交互的重要通信协议。然而，由于固有的安全风险，CAN正面临严峻的安全挑战。入侵检测系统（IDS）是修复车辆电子与系统漏洞的关键安全组件。然而，现有的IDS无法识别复杂攻击，并且由于能力瓶颈导致较高的误报率。本文提出了一种自监督多知识融合的异常检测模型，称为MKF-ADS。具体而言，该方法设计了一个集成框架，包括具有注意力机制（STcAM）模块的时空相关性和补丁稀疏变换器模块（PatchST）。带有精细剪枝的STcAM使用一维卷积（Conv1D）提取空间特征，随后利用双向长短期记忆（Bi-LSTM）提取时间特征，其中注意力机制将关注重要的时间步骤。同时，PatchST从独立的单变量时间序列中捕获组合的上下文特征。最后，所提出的方法基于知识蒸馏，将STcAM作为学生模型，学习内在知识并具备模仿PatchST的能力。我们在六个模拟攻击场景（涵盖不同的CAN ID和时间步长）以及两个真实攻击场景中进行了大量实验，展示了有竞争力的预测和检测性能。与同一范式下的基线相比，错误率和误报率分别为2.62%和2.41%，并实现了97.3%的F1分数。
英文摘要：
Control Area Network (CAN) is an essential communication protocol that interacts between Electronic Control Units (ECUs) in the vehicular network. However, CAN is facing stringent security challenges due to innate security risks. Intrusion detection systems (IDSs) are a crucial safety component in remediating Vehicular Electronics and Systems vulnerabilities. However, existing IDSs fail to identify complexity attacks and have higher false alarms owing to capability bottleneck. In this paper, we propose a self-supervised multi-knowledge fused anomaly detection model, called MKF-ADS. Specifically, the method designs an integration framework, including spatial-temporal correlation with an attention mechanism (STcAM) module and patch sparse-transformer module (PatchST). The STcAM with fine-pruning uses one-dimensional convolution (Conv1D) to extract spatial features and subsequently utilizes the Bidirectional Long Short Term Memory (Bi-LSTM) to extract the temporal features, where the attention mechanism will focus on the important time steps. Meanwhile, the PatchST captures the combined contextual features from independent univariate time series. Finally, the proposed method is based on knowledge distillation to STcAM as a student model for learning intrinsic knowledge and cross the ability to mimic PatchST. We conduct extensive experiments on six simulation attack scenarios across various CAN IDs and time steps, and two real attack scenarios, which present a competitive prediction and detection performance. Compared with the baseline in the same paradigm, the error rate and FAR are 2.62\% and 2.41\% and achieve a promising F1-score of 97.3\%.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
