{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,11,1]],"date-time":"2025-11-01T13:52:10Z","timestamp":1762005130457,"version":"build-2065373602"},"reference-count":35,"publisher":"MDPI AG","issue":"11","license":[{"start":{"date-parts":[[2019,11,8]],"date-time":"2019-11-08T00:00:00Z","timestamp":1573171200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"the National Cryptography Development Fund","award":["MMJJ20180106"],"award-info":[{"award-number":["MMJJ20180106"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Symmetry"],"abstract":"<jats:p>An internet of vehicles allows intelligent automobiles to interchange messages with other cars, traffic management departments, and data analysis companies about vehicle identification, accident detection, and danger warnings. The implementation of these features requires Internet of Things system support. Smart cars are generally equipped with many (hundreds or even thousands of) sensors and microcomputers so that drivers gain more information about travel. The connection between the in-vehicle network and the Internet can be leveraged by the attackers in a malicious manner and thus increases the number of ways the in-vehicle network can now be targeted. Protecting increasingly intelligent vehicle systems becomes more difficult, especially because a network of many different devices makes the system more vulnerable than ever before. The paper assumes a generic threat model in which attackers can access the controller area network (CAN) bus via common access points (e.g., Bluetooth, OBD-II, Wi-Fi, physical access, and cellular communication, etc). A machine learning based simplified attention (SIMATT)-security control unit (SECCU) symmetry framework is proposed towards a novel and lightweight anomaly detecting mechanism for the in-vehicle network. For this framework, we propose two new models, SECCU and SIMATT, and obtain state-of-the-art anomaly detecting performance when fusing the former to the latter. Regardless of the training phase or the detection phase, we strive to minimize the computational cost and thereby obtain a lightweight anomaly detection method. In particular, the SECCU model has only one layer of 500 computing cells and the SIMATT model has been improved to reduce its computational costs. Through substantial experiment comparisons (with various classical algorithms, such as LSTM, GRU, GIDS, RNN, or their variations), it is demonstrated that the SIMATT-SECCU framework achieves an almost optimal accuracy and recall rate.<\/jats:p>","DOI":"10.3390\/sym11111388","type":"journal-article","created":{"date-parts":[[2019,11,8]],"date-time":"2019-11-08T11:30:19Z","timestamp":1573212619000},"page":"1388","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":29,"title":["Internet of Things Meets Vehicles: Sheltering In-Vehicle Network through Lightweight Machine Learning"],"prefix":"10.3390","volume":"11","author":[{"given":"Junchao","family":"Xiao","sequence":"first","affiliation":[{"name":"School of Systems Science and Engineering, Sun Yat-Sen University, Guangdong 510006, China"},{"name":"School of Software Engineering, East China Normal University, Shanghai 200000, China"}]},{"given":"Hao","family":"Wu","sequence":"additional","affiliation":[{"name":"National Computer Network Emergency Response Technical Team\/Coordination Center, Beijing 100029, China"}]},{"given":"Xiangxue","family":"Li","sequence":"additional","affiliation":[{"name":"School of Software Engineering, East China Normal University, Shanghai 200000, China"}]}],"member":"1968","published-online":{"date-parts":[[2019,11,8]]},"reference":[{"key":"ref_1","first-page":"993","article-title":"A practical wireless attack on the connected car and security protocol for in-vehicle CAN","volume":"16","author":"Woo","year":"2015","journal-title":"IEEE Trans. Intell. Transp. Syst."},{"key":"ref_2","unstructured":"Foster, I., Prudhomme, A., Koscher, K., and Savage, S. (2015, January 10\u201311). Fast and vulnerable: A story of telematic failures. Proceedings of the USENIX Workshop on Offensive Technologies, Washington, DC, USA."},{"key":"ref_3","unstructured":"Golde, N., Redon, K., and Borgaonkar, R. (2012, January 5\u20138). Weaponizing femtocells: The effect of rogue devices on mobile telecommunications. Proceedings of the NDSS Symposium, San Diego, CA, USA."},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"4472","DOI":"10.1109\/TVT.2014.2371470","article-title":"Gateway framework for in-vehicle networks based on CAN, FlexRay, and Ethernet","volume":"64","author":"Kim","year":"2015","journal-title":"IEEE Trans. Veh. Technol."},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"899","DOI":"10.1016\/j.mechatronics.2005.05.002","article-title":"Development of the electronic control unit for the rack-actuating steer-by-wire using the hardware-in-the-loop simulation system","volume":"15","author":"Park","year":"2005","journal-title":"Mechatronics"},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"534","DOI":"10.1109\/TITS.2014.2320605","article-title":"Intra-vehicle networks: A review","volume":"16","author":"Tuohy","year":"2015","journal-title":"IEEE Trans. Intell. Transp. Syst."},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"74","DOI":"10.1109\/MCOM.2006.1580935","article-title":"Vehicle-to-vehicle wireless communication protocols for enhancing highway traffic safety","volume":"44","author":"Biswas","year":"2006","journal-title":"IEEE Commun. Mag."},{"key":"ref_8","doi-asserted-by":"crossref","first-page":"113","DOI":"10.1049\/cce:19990304","article-title":"An overview of controller area network","volume":"10","author":"Farsi","year":"1999","journal-title":"Comp. Control Eng. J."},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"58","DOI":"10.1109\/MNET.2018.1700319","article-title":"Connected vehicles\u2019 security from the perspective of the In-vehicle network","volume":"32","author":"Li","year":"2018","journal-title":"IEEE Netw."},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"2017","DOI":"10.1007\/s11071-014-1265-9","article-title":"A new car-following model with consideration of inter-vehicle communication","volume":"76","author":"Tang","year":"2014","journal-title":"Nonlinear Dyn."},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"2034","DOI":"10.1109\/TII.2013.2239301","article-title":"Efficient protocols for secure broadcast in controller area networks","volume":"9","author":"Groza","year":"2013","journal-title":"IEEE Trans. Ind. Inform."},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"2248","DOI":"10.1109\/TITS.2016.2519464","article-title":"A practical security architecture for in-vehicle CAN-FD","volume":"17","author":"Woo","year":"2016","journal-title":"IEEE Trans. Intell. Transp. Syst."},{"key":"ref_13","doi-asserted-by":"crossref","unstructured":"Muter, M., and Asaj, N. (2011, January 5\u20139). Entropy-based anomaly detection for in- vehicle networks. Proceedings of the 2011 IEEE Intelligent Vehicles Symposium (IV), Baden-Baden, Germany.","DOI":"10.1109\/IVS.2011.5940552"},{"key":"ref_14","first-page":"52","article-title":"Anomaly intrusion detection method for vehicular networks based on survival analysis","volume":"14","author":"Lan","year":"2018","journal-title":"Veh. Commun."},{"key":"ref_15","doi-asserted-by":"crossref","unstructured":"Song, H.M., and Kim, H.K. (2016, January 13\u201315). Intrusion detection system based on the analysis of time intervals of CAN messages for in-vehicle network. Proceedings of the International Conference on Information Networking (ICOIN), Kota Kinabalu, Malaysia.","DOI":"10.1109\/ICOIN.2016.7427089"},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Seo, E., Song, H.M., and Kim, H.K. (2018, January 28\u201330). GIDS: GAN based intrusion detection system for in-vehicle network. Proceedings of the 16th Annual Conference on Privacy, Security and Trust (PST), Belfast, UK.","DOI":"10.1109\/PST.2018.8514157"},{"key":"ref_17","doi-asserted-by":"crossref","unstructured":"Tariq, S., Lee, S., Kim, H.K., and Woo, S.S. (2018, January 13). Detecting In-vehicle CAN message attacks using heuristics and RNNs. Proceedings of the International Workshop on Information and Operational Technology Security Systems, Heraklion, Greece.","DOI":"10.1007\/978-3-030-12085-6_4"},{"key":"ref_18","doi-asserted-by":"crossref","unstructured":"Larson, U.E., Nilsson, D.K., and Jonsson, E. (2008, January 4\u20136). An approach to specification-based attack detection for in-vehicle networks. Proceedings of the IEEE Intelligent Vehicles Symposium, Eindhoven, The Netherlands.","DOI":"10.1109\/IVS.2008.4621263"},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"9091","DOI":"10.1109\/ACCESS.2018.2799210","article-title":"A distributed anomaly detection system for in-vehicle network using HTM","volume":"6","author":"Wang","year":"2018","journal-title":"IEEE Access"},{"key":"ref_20","unstructured":"Hu, W., Liao, Y., and Vemuri, V.R. (2003, January 21\u201324). Robust anomaly detection using support vector machines. Proceedings of the International Conference on Machine Learning, Washington, DC, USA."},{"key":"ref_21","doi-asserted-by":"crossref","first-page":"49375","DOI":"10.1109\/ACCESS.2018.2841884","article-title":"Investigating the effects of attack detection for in-vehicle networks based on clock drift of ECUs","volume":"6","author":"Li","year":"2018","journal-title":"IEEE Access"},{"key":"ref_22","doi-asserted-by":"crossref","unstructured":"Xiao, J., Wu, H., and Li, X. (2019, January 10\u201312). Robust and Self-Evolving IDS for In-Vehicle Network by Enabling Spatiotemporal Information. Proceedings of the IEEE 21st International Conference on High Performance Computing and Communications, Zhangjiajie, China.","DOI":"10.1109\/HPCC\/SmartCity\/DSS.2019.00193"},{"key":"ref_23","unstructured":"Sutskever, I., Vinyals, O., and Le, Q.V. (2014). Sequence to sequence learning with neural networks. arXiv."},{"key":"ref_24","doi-asserted-by":"crossref","unstructured":"Cho, K., van Merrienboer, B., Gulcehre, C., Bahdanau, D., Bougares, F., Schwenk, H., and Bengio, Y. (2014). Phrase representations using RNN encoder-decoder for statistical machine translation. arXiv.","DOI":"10.3115\/v1\/D14-1179"},{"key":"ref_25","unstructured":"Chung, J., Gulcehre, C., Cho, K., and Bengio, Y. (2015). Gated feedback recurrent neural networks. arXiv."},{"key":"ref_26","unstructured":"Jozefowicz, R., Zaremba, W., and Sutskever, I. (2015, January 6\u201311). An empirical exploration of recurrent network architectures. Proceedings of the International Conference on Machine Learning, Lille, France."},{"key":"ref_27","doi-asserted-by":"crossref","first-page":"2222","DOI":"10.1109\/TNNLS.2016.2582924","article-title":"LSTM: A search space odyssey","volume":"28","author":"Greff","year":"2017","journal-title":"IEEE Trans. Neural Netw. Learning Syst."},{"key":"ref_28","doi-asserted-by":"crossref","unstructured":"Parikh, A.P., T\u00e4ckstr\u00f6m, O., Das, D., and Uszkoreit, J. (2016). A decomposable attention model for natural language inference. arXiv.","DOI":"10.18653\/v1\/D16-1244"},{"key":"ref_29","unstructured":"Pappas, N., and Popescu-Belis, A. (2017). Multilingual hierarchical attention networks for document classification. arXiv."},{"key":"ref_30","unstructured":"Sukhbaatar, S., Szlam, A., Weston, J., and Fergus, R. (2015). End-to-end memory networks. arXiv."},{"key":"ref_31","doi-asserted-by":"crossref","unstructured":"Lee, H., Jeong, S.H., and Kim, H.K. (2017, January 27\u201329). OTIDS: A novel intrusion detection system for in-vehicle network by using remote frame. Proceedings of the 15th Annual Conference on Privacy, Security and Trust, PST, Calgary, AB, Canada.","DOI":"10.1109\/PST.2017.00017"},{"key":"ref_32","unstructured":"Cho, K.-T., and Shin, K.G. (2016, January 10\u201312). Fingerprinting electronic control units for vehicle intrusion detection. Proceedings of the USENIX Security Symposium, Austin, TX, USA."},{"key":"ref_33","doi-asserted-by":"crossref","first-page":"5","DOI":"10.1023\/A:1010933404324","article-title":"Random Forests","volume":"45","author":"Breiman","year":"2001","journal-title":"Mach. Learning"},{"key":"ref_34","doi-asserted-by":"crossref","first-page":"21","DOI":"10.1016\/j.gene.2014.11.026","article-title":"Comparisons of isomir patterns and classification performance using the rank-based manova and 10-fold cross-validation","volume":"569","author":"Zhang","year":"2017","journal-title":"Gene"},{"key":"ref_35","doi-asserted-by":"crossref","first-page":"141","DOI":"10.1002\/bimj.201200088","article-title":"Efficient approximate k-fold and leave-one-out cross-validation for ridge regression","volume":"55","author":"Meijer","year":"2013","journal-title":"Biom. J."}],"container-title":["Symmetry"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2073-8994\/11\/11\/1388\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,11]],"date-time":"2025-10-11T13:32:59Z","timestamp":1760189579000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2073-8994\/11\/11\/1388"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2019,11,8]]},"references-count":35,"journal-issue":{"issue":"11","published-online":{"date-parts":[[2019,11]]}},"alternative-id":["sym11111388"],"URL":"https:\/\/doi.org\/10.3390\/sym11111388","relation":{},"ISSN":["2073-8994"],"issn-type":[{"type":"electronic","value":"2073-8994"}],"subject":[],"published":{"date-parts":[[2019,11,8]]}}}