ZeroCAN: Anomaly-Based Zero-Day Attack Detection in Vehicular CAN Bus NetworksShow others and affiliations
2025 (English)In: 2025 33rd Euromicro International Conference on Parallel, Distributed, and Network-Based Processing (PDP), Piscataway: IEEE, 2025, p. 121-128Conference paper, Published paper (Refereed)
Abstract [en]
Zero-day attacks present a significant security threat to vehicular networks, exploiting vulnerabilities at both software and hardware levels within such systems that remain undiscovered. Mitigating these threats is essential to ensuring the safety and security of vehicular systems. Support Vector Machine (SVM) is a good candidate for anomaly detection of zero-day attacks within vehicular networks because it can handle highdimensional data and effectively distinguish between normal and abnormal patterns in complex and dynamic environments. A trained SVM on the normal operation data of in-vehicular network can identify flag deviations, thus making it effective in the detection of any previously unknown attack patterns, which is a common behaviour of zero-day attacks. In this paper, we introduce an anomaly detection method called "ZeroCAN"which models the behaviour of every single electronic control unit on the network with a separate SVM and a set of high-level features that capture the timing and data payload aspects of CANbus traffic. This approach achieves an anomaly detection rate of over 99% and a false positive rate below 0.01% during normal operation in most cases. © 2025 IEEE.
Place, publisher, year, edition, pages
Piscataway: IEEE, 2025. p. 121-128
Series
Parallel, Distributed and Network-Based Processing (PDP), ISSN 1066-6192, E-ISSN 2377-5750
Keywords [en]
Anomaly detection, CAN bus IDS, Feature engineering, Zero-day
National Category
Artificial Intelligence Computer Sciences Computer Engineering Security, Privacy and Cryptography Algorithms
Research subject
Smart Cities and Communities, Future industry
Identifiers
URN: urn:nbn:se:hh:diva-55938DOI: 10.1109/PDP66500.2025.00025ISBN: 979-8-3315-2494-4 (print)ISBN: 979-8-3315-2493-7 (electronic)OAI: oai:DiVA.org:hh-55938DiVA, id: diva2:1955631
Conference
33rd Euromicro International Conference on Parallel, Distributed, and Network-Based Processing, PDP 2025, Turin, Italy, 12-14 March, 2025
2025-04-302025-04-302025-10-01Bibliographically approved