Using Machine Learning to Detect Anomalies in Embedded Networks in Heavy Vehicles

Hossein Shirazi, Indrakshi Ray, Charles Anderson

Abstract: Modern automobiles have more than 70 electronic control units (ECUs) and 100 million lines of code to improve safety, fuel economy, performance, durability, user experience, and to reduce emissions. Automobiles are becoming increasingly interconnected with the outside world. Consequently, modern day automobiles are becoming more prone to cyber security attacks. Towards this end, we present an approach that uses machine learning to detect abnormal behavior, including malicious ones, on embedded networks in heavy vehicles. Our modular algorithm uses machine learning approaches on the internal network traffic in heavy vehicles to generate warning alarms in real-time. We tested our hypothesis on five separate data logs that characterize the operations of heavy vehicles having different specifications under varying driving conditions. We report a malicious detection rate of 98–99% and a mean accuracy rate of 96–99% across all experiments using five-fold cross-validation. Our analysis also shows that with a small subset of hand-crafted features, the complex dynamic behavior of heavy vehicle ECUs can be predicted and classified as normal or abnormal.