Philipp Meyer: Systematic Assessment of Anomaly Detectors

Connected cars are susceptible to cyberattacks. Security and safety of future vehicles highly depend on a holistic protection of automotive core components, of which the time sensitive backbone network takes a central role. These onboard TSN require monitoring for safety and -- as versatile platforms to host NADS -- for security. Still a thorough evaluation of anomaly detection methods in the context of hard real-time operations, automotive protocol stacks, and domain specific attack vectors are missing along with appropriate input datasets.
In this paper, we present an assessment framework that allows for reproducible, comparable, and rapid evaluation of detection algorithms. It is based on a simulation toolchain, which contributes configurable topologies, traffic streams, anomalies, attacks, and detection metrics. We demonstrate the monitoring of a comprehensive in-vehicular network with its communication flows, on which we model traffic anomalies. We evaluate detection mechanisms in a case study and reveal how the detection performance is influenced by different combinations of TSN traffic flows and anomaly types. Our approach translates to other hard real-time Ethernet domains, such as industrial facilities, airplanes, and UAVs.