Binary Logistic Regression based Intrusion Detection System for CAN bus Security

The complex distributed systems installed in vehicles represent the cutting edge of the automotive industry. Electronic control units communicate with each other by sending and receiving messages over a well-known protocol called the Controller Area Network (CAN) bus system. Car Broadcast is a new, but insecure, way to communicate between external electronic devices. However, today’s vehicles are on the brink of security because the CAN network lacks a secure authentication and authorization mechanism. The rise in cyber attacks such as spoofing, spoofing and most commonly denial of service attacks is the result of uncertain measures in the CAN bus network. Although many intrusion detection systems have been developed to provide more secure communication in the vehicle, CAN is still far from being the most secure communication protocol. Since cyber attacks can come from a little-known or completely unknown source, it is essential to take a probabilistic approach based on previous observations from previous attacks. Therefore, we propose a new intrusion detection system that uses binary logistic regression (BLR) to detect and mitigate attacks on a CAN bus network. Binary logistic regression is a very popular predictive model that is widely used in various fields. In binary logistic regression, data is first analyzed, then the probability of individual events is estimated by observing previous data, and then a binary classification model is created. An evaluation of the well-known Nsl-kdd and Kdd-99 datasets shows that our proposed method has a dominant overall performance. The final detection rate is 099.031% using Nsl-kdd with a positive rate as low as 00.073% and the rate of detection is 099.043% using kdd-99 with a positive false rate as low as 00.046%˙ Specifically, to detect denial of service (DoS) attacks, the proposed system achieved a detection rate of 099.061% and 099.098% in Nsl-kdd and kdd-99 dataset respectively. Comparative evaluation confirmed that BLR is more reliable as a memory unit for intrusion detection system.