用图神经网络提升无人机CAN总线入侵检测能力,效果优于传统方法。
Graph-Powered Defense: Controller Area Network Intrusion Detection for Unmanned Aerial Vehicles
- 将CAN消息转为图结构,利用图模型检测攻击
- 图注意力网络等模型在无协议特征下仍保持高精度
- 适合无人机安全防护、自动驾驶系统开发者参考
过去十年,无人机在配送、农业和环境监测等领域广泛应用。然而,无人机对网络安全攻击,特别是控制器局域网(CAN)总线攻击,仍缺乏足够防御能力。本研究针对这一问题,提出一种基于图结构的入侵检测系统(IDS),依托简化应用层车载通信与网络协议(UAVCAN)。首先,根据UAVCAN协议规范解码CAN消息;其次,提出将表格型UAVCAN消息转化为图结构的完整方法;最后,采用多种图神经网络模型(包括图卷积网络GCNN、图注意力网络GAT、GraphSAGE及图结构变压器)检测各类攻击。实验表明,如GAT、GraphSAGE和图结构变压器等归纳式模型,在仅依赖最小协议信息的前提下,检测性能可媲美甚至超越传统的传导式模型(如GCNN)。此外,与单层LSTM基线相比,所有图模型均无需解码协议特征即可实现更高检测准确率,展现出良好的协议无关性,为无人机CAN总线安全提供了通用且鲁棒的解决方案。
原文摘要 · Abstract (English)
The network of services, including delivery, farming, and environmental monitoring, has experienced exponential expansion in the past decade with Unmanned Aerial Vehicles (UAVs). Yet, UAVs are not robust enough against cyberattacks, especially on the Controller Area Network (CAN) bus. The CAN bus is a general-purpose vehicle-bus standard to enable microcontrollers and in-vehicle computers to interact, primarily connecting different Electronic Control Units (ECUs). In this study, we focus on solving some of the most critical security weaknesses in UAVs by developing a novel graph-based intrusion detection system (IDS) leveraging the Uncomplicated Application-level Vehicular Communication and Networking (UAVCAN) protocol. First, we decode CAN messages based on UAVCAN protocol specification; second, we present a comprehensive method of transforming tabular UAVCAN messages into graph structures. Lastly, we apply various graph-based machine learning models for detecting cyber-attacks on the CAN bus, including graph convolutional neural networks (GCNNs), graph attention networks (GATs), Graph Sample and Aggregate Networks (GraphSAGE), and graph structure-based transformers. Our findings show that inductive models such as GATs, GraphSAGE, and graph-based transformers can achieve competitive and even better accuracy than transductive models like GCNNs in detecting various types of intrusions, with minimum information on protocol specification, thus providing a generic robust solution for CAN bus security for the UAVs. We also compared our results with baseline single-layer Long Short-Term Memory (LSTM) and found that all our graph-based models perform better without using any decoded features based on the UAVCAN protocol, highlighting higher detection performance with protocol-independent capability.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。