LogWhisperer: Multi-log Semantic Similarity Analysis Based Intelligent Vehicle Anomaly Detection Without Log Template

Hongyi Guo, Kun Yang, Kui Ren

Abstract: In recent years, the global intelligent vehicles market size has been growing rapidly and is projected to reach 6,861.45 billion U.S. dollars by 2033, according to a research report published by Spherical Insights [21]. Conventional and emerging security challenges have been gravely threatening the security of intelligent vehicles, the key infrastructure of digital society, and thus posing a threat to national security. Logs have typically been exploited as data sources for threat analysis and anomaly detection. Most existing logs-based anomaly detection approaches are designed for defending distributed computing systems or high-performance computers, and cannot be easily adapted for protecting intelligent vehicles. Worse still, most of prior solutions rely on log templates for anomaly detection, which will face the issue of explosion in the number of log templates while defending modern intelligent vehicles. Previous work typically uses logs from open-source libraries, which are outdated and have gone through pre-processing. To overcome these limitations, we propose LogWhisperer, a semantic similarity analysis based approach that investigates multiple types of logs for detecting abnormal behaviors of intelligent vehicles. LogWhisperer jointly analyzes logs from different levels of multiple subsystems in the vehicle and detects abnormal behaviors by evaluating the semantic similarity between actual log sequence and projected log sequence. Compared with anomaly detection approaches that rely on log templates, LogWhisperer has better platform portability since it discards log templates and its data pre-processing procedure does not change depending on specific scenarios.