A Multitask Learning Approach for Intrusion Detection in Controller Area Networks

Intrusion detection on in-vehicle networks requires high accuracy, which is reported by many papers so far, but also computational efficiency to make it suitable for real-world scenarios. The achievement of both requirements at the same time becomes harder to achieve, especially as the number of attacks diversifies. An approach to leverage computational costs is the use of sliding windows, i.e., batch processing, which extends the detection over multiple frames, but the use of multitask learning is also advantageous because a number of layers are shared between classes to extract common relevant features. While indeed the greatest computational gains are from the use of a sliding window, multitask learning has benefits too and is in fact necessary as multiple attack types can coexist in the same window. We explore the benefits of this approach on three existing attack datasets and we also build our own dataset that garners more attack complexity so that we can concretely measure the benefits of multitask learning both in terms of detection rate and computational savings. Our approach considers the feature-level similarity between attack types and legitimate frames, extracted from the mutual information between the two, and extends detection over windows of multiple frames, which justify multitask learning as frames belonging to different classes can co-exist in the same window.