Decision Tree-Based Rule Derivation for Intrusion Detection in Safety-Critical Automotive Systems
Abstract
Intrusion Detection Systems (IDSs) are being introduced into safety-critical systems such as connected vehicles. Since the behavior and effectiveness of measures are validated before approval, the decisions made by an IDS are required to be traceable and the IDS also needs to work efficiently on resource-constrained embedded systems. These requirements complicate the direct use of Machine Learning (ML) approaches in IDS design. In this paper, we propose an approach to using ML to generate rules for an efficient rule-based IDS like Snort. Our approach eases the time-consuming and difficult process of creating a rule set. We use decision trees to generate rules that can be used by experts as a basis for creating a rule set for a specific safety-critical use case. In addition, we use long short-term memory methods to circumvent the problem of limited training data availability, a common limitation in safety-critical systems. Our implementation and evaluation shows the feasibility of our approach to derive specific IDS rules for such systems.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
PCA may not always be suitable for all datasets or analysis goals, and its effectiveness depends on the underlying structure of the data.
“However, it is important to note that PCA may not always be suitable for all datasets or analysis goals, and its effectiveness depends on the underlying structure of the data [17] [56].”
From Comparative Analysis of Intrusion Detection Systems and Machine Learning Based Model Analysis through Decision Tree (2023) · cites this paper as [56]
Cites
Scikit-learn: Machine Learning in Python
Pedregosa, F., Varoquaux, G., Gramfort, A., Michel, V., Thirion, B., Grisel, O., Blondel, M., Müller, A., Nothman, J., Louppe, G., et al. (2012) · arXiv · doi:10.48550/arxiv.1201.0490 · Cited by 71,016 · see citing works
Moustafa, N., & Slay, J. (2015) · 2015 Military Communications and Information Systems Conference (MilCIS) · doi:10.1109/milcis.2015.7348942 · Cited by 4,033 · see citing works
Outside the Closed World: On Using Machine Learning for Network Intrusion Detection
Sommer, R., & Paxson, V. (2010) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2010.25 · Cited by 2,316 · see citing works
Deep learning for cyber security intrusion detection: Approaches, datasets, and comparative study
Ferrag, M. A., Maglaras, L. A., Moschoyiannis, S., & Janicke, H. (2019) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2019.102419 · Cited by 1,298 · see citing works
Machine Learning and Deep Learning Methods for Intrusion Detection Systems: A Survey
Liu, H., & Lang, B. (2019) · Applied Sciences · doi:10.3390/app9204396 · Cited by 1,133 · see citing works
Cloud-Based Cyber-Physical Intrusion Detection for Vehicles Using Deep Learning
Loukas, G., Vuong, T. P., Heartfield, R., Sakellari, G., Yoon, Y., & Gan, D. (2017) · IEEE Access · doi:10.1109/access.2017.2782159 · Cited by 278 · see citing works
AI-IDS: Application of Deep Learning to Real-Time Web Intrusion Detection
Kim, A., Park, M., & Lee, D. H. (2020) · IEEE Access · doi:10.1109/access.2020.2986882 · Cited by 278 · see citing works
Intrusion Detection Using Big Data and Deep Learning Techniques
Faker, O., & Doğdu, E. (2019) · ACM Southeast Conference (ACMSE) · doi:10.1145/3299815.3314439 · Cited by 228 · see citing works
Shah, S. A. R., & Issac, B. (2017) · Future Generation Computer Systems · doi:10.1016/j.future.2017.10.016 · Cited by 224 · see citing works
Khraisat, A., Gondal, I., Vamplew, P. W., et al. (2020) · Electronics · doi:10.3390/electronics9010173 · Cited by 214 · see citing works
Intrusion Detection Systems for Intra-Vehicle Networks: A Review
Al-Jarrah, O. Y., Maple, C. R., Dianati, M., Oxtoby, D., & Mouzakitis, A. (2019) · IEEE Access · doi:10.1109/access.2019.2894183 · Cited by 187 · see citing works
A Software Implementation of a Genetic Algorithm Based Approach to Network Intrusion Detection
Gong, R. H., Zulkernine, M., & Abolmaesumi, P. (2005) · doi:10.1109/snpd-sawn.2005.9 · Cited by 137 · see citing works
Ren, J., Guo, J., Wang, Q., Huang, Y., Hao, X., & Hu, J. (2019) · Security and Communication Networks · doi:10.1155/2019/7130868 · Cited by 130 · see citing works
Dynamic Fuzzy Rule Interpolation and Its Application to Intrusion Detection
Naik, N., Diao, R., & Shen, Q. (2017) · IEEE Transactions on Fuzzy Systems · doi:10.1109/tfuzz.2017.2755000 · Cited by 117 · see citing works
Hybrid intrusion detection and signature generation using Deep Recurrent Neural Networks
Kaur, S., & Singh, M. (2019) · Neural Computing and Applications · doi:10.1007/s00521-019-04187-9 · Cited by 97 · see citing works
Evolving statistical rulesets for network intrusion detection
Rastegari, S., Hingston, P., & Lam, C. (2015) · Applied Soft Computing · doi:10.1016/j.asoc.2015.04.041 · Cited by 60 · see citing works
Gómez, J., Gil, C., Baños, R., et al. (2012) · Soft Computing · doi:10.1007/s00500-012-0890-9 · Cited by 50 · see citing works
A Novel Hybrid IDS Based on Modified NSGAII-ANN and Random Forest
Golrang, A., Golrang, A. M., Yayilgan, S. Y., & Elezaj, O. (2020) · Electronics · doi:10.3390/electronics9040577 · Cited by 48 · see citing works
AutoIDS: Auto-encoder Based Method for Intrusion Detection SystemPreprint
Gharib, M., Mohammadi, B., Dastgerdi, S. H., & Sabokrou, M. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1911.03306 · Cited by 36 · see citing works
Rule Generation for Signature Based Detection Systems of Cyber Attacks in IoT Environments
Soe, Y. N., Feng, Y., Santosa, P. I., Hartanto, R., & Sakurai, K. (2019) · Bulletin of Networking, Computing, Systems, and Software · Cited by 32 · see citing works
Probing the Limits of Anomaly Detectors for Automobiles with a Cyberattack Framework
Taylor, A., Leblanc, S. P., & Japkowicz, N. (2018) · IEEE Intelligent Systems · doi:10.1109/mis.2018.111145054 · Cited by 31 · see citing works
Automated flow-based rule generation for network intrusion detection systems
Fallahi, N., Sami, A., & Tajbakhsh, M. (2016) · Iranian Conference on Electrical Engineering · doi:10.1109/iraniancee.2016.7585840 · Cited by 23 · see citing works
Intrusion Detection for SOME/IP: Challenges and Opportunities
Gehrmann, T., & Duplys, P. (2020) · Euromicro Conference on Digital System Design (DSD) · doi:10.1109/dsd51259.2020.00096 · Cited by 22 · see citing works
Dynamic rule generation for SCADA intrusion detection
Nivethan, J., & Papa, M. (2016) · doi:10.1109/ths.2016.7568964 · Cited by 20 · see citing works
Extending Signature-based Intrusion Detection Systems With Bayesian Abductive ReasoningPreprint
Ganesan, A., Parameshwarappa, P., Peshave, A., et al. (2019) · arXiv (Cornell University) · doi:10.13016/m2r7vz-rgfh · Cited by 18 · see citing works
Intrusion Detection System Enhanced by Hierarchical Bidirectional Fuzzy Rule Interpolation
Jin, S., Jiang, Y., & Peng, J. (2018) · Conference proceedings/Conference proceedings - IEEE International Conference on Systems, Man, and Cybernetics · doi:10.1109/smc.2018.00010 · Cited by 9 · see citing works
Model based rules generation for Intrusion Detection System for industrial systems
Monzer, M. H., Beydoun, K., & Flaus, J. (2019) · International Conference on Control, Automation and Diagnosis (ICCAD) · doi:10.1109/iccad46983.2019.9037882 · Cited by 7 · see citing works
Experimental load test statistics for the selected IPS tools on low-performance IoT devices
Zitta, T., Lucki, M., Vojtěch, L., et al. (2019) · Journal of Electrical Engineering · doi:10.2478/jee-2019-0058 · Cited by 3 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
Azam, Z., Islam, M. M., & Huda, M. N. (2023) · IEEE Access · doi:10.1109/access.2023.3296444 · Cited by 265 · see citing works
- Authors
- Buschlinger, L., Rieke, R., Sarda, S., & Kraus, C.
- Affiliations
- Fraunhofer Institute for Secure Information Technology (DE)
- Fraunhofer Singapore (SG)
- Darmstadt University of Applied Sciences (DE)
- ORCID
- Rieke, Roland
- Venue
- 2022 30th Euromicro International Conference on Parallel, Distributed and Network-based Processing (PDP)
- Publisher
- IEEE
- Published
- 2022-03
- Pages
- 246-254
- ISSN
- 1066-6192 (ISSN-L)
- OpenAlex
- W4224287509
- Cited by
- 14
- References
- 28
- Citations by year
- 2026: 2 · 2025: 2 · 2024: 4 · 2023: 6
- FWCI
- 2.91
- Type
- conference paper
- Language
- en
- Open access
- closed
- Locations
- Euromicro International Conference on Parallel, Distributed and Network-Based Processing (PDP) (publishedVersion)
- Fraunhofer-Publica (Fraunhofer-Gesellschaft) (submittedVersion)
- Funders
- Ministry of Education
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Hardware and Architecture › Network Packet Processing and Optimization
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Keywords
- intrusion detection systems, decision tree, rule generation, connected vehicles, Snort, long short-term memory, limited training data, traceability, embedded systems
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
