Cited by 58Network Security and Intrusion DetectionNetwork Packet Processing and OptimizationInternet Traffic Analysis and Secure E-voting

TOW-IDS: Intrusion detection system based on three overlapped wavelets for automotive ethernet

Han, Mee Lan, Kwak, Byung Il, Kim, Huy Kang·2023·IEEE Transactions on Information Forensics and Security

Abstract

Devices that ensure vehicle and driver safety or provide services to drivers generate a substantial amount of network traffic. The traffic is transmitted to the In-Vehicle Network (IVN) depending on the defined function. Consequently, to quickly process a lot of traffic transmitted to the IVN, an advanced network protocol such as Automotive Ethernet is necessary. However, owing to the connectivity reinforcement between devices inside a vehicle and external networks, attack vectors and vulnerabilities can be easily inherited from an established Ethernet to Automotive Ethernet. The present study proposes a method for detecting and identifying abnormalities in Automotive Ethernet based on wavelet transform and deep convolutional neural network. First, we define attack scenarios and extract normal and abnormal data corresponding to these scenarios. Second, we conduct several preprocesses, such as fixing the packet size and normalizing the network image data. Finally, we conduct extensive evaluations of the proposed method’s performance, considering the size of network image data and multi-resolution levels. The results demonstrate that the proposed method can effectively detect an abnormality. Furthermore, the results suggest that the our method is more effective in terms of time-cost compared to default ResNet and EfficientNet methods.

Integrity signals

Registry

Crossref · 10.1109/tifs.2022.3221893

Cites

34 of 34 references verified0 citation errors · 0 not checkable

Statistics

Recomputing p-values needs the paper’s full text.

Claims the paper makes

This paper’s full text isn’t openly available, so its claims and self-check weren’t run. The registry and citation checks still apply.

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • The dataset distribution for time-series dependency-based techniques reveals a concentration on a limited set of benchmarks, with CIC-IDS2017, UNSW-NB15, IoT-23, LITNET-2020, NetML-2020, CIC-DDoS2019, and N-BaIoT widely used, especially for botnet, DDoS, and generic network intrusions, while only a subset of studies leverage ICS/CPS-specific traces such as Alstom TCMS traffic, multi-domain ICS-CPS

    “Fourth, the dataset distribution again reveals a concentration on a limited set of benchmarks. CIC-IDS2017, UNSW-NB15, IoT-23, LITNET-2020, NetML-2020, CIC-DDoS2019, and N-BaIoT are widely used to evaluate time-series dependency-based techniques, especially for botnet, DDoS, and generic network intrusions [35,38,40,43]. Only a subset of studies leverage ICS/CPS-specific traces such as Alstom TCMS”

Cites

Flagged first, then by citations

Cited by

Sorted by citations

Authors
Han, M. L., Kwak, B. I., & Kim, H. K.
Affiliations
  • Korea University (KR)
  • Hallym University (KR)
Venue
IEEE Transactions on Information Forensics and Security
Published
2023
Volume
18
Pages
411-422
ISSN
  • 1556-6013 (ISSN-L)
  • 1556-6021
OpenAlex
W4311080744
Cited by
58
References
34
Citations by year
2026: 14 · 2025: 27 · 2024: 10 · 2023: 7
FWCI
4.88
Type
journal article
Language
en
Open access
closed
Locations
IEEE Transactions on Information Forensics and Security (publishedVersion)
Funders
  • Institute of Information & communications Technology Planning & Evaluation
  • Korea government [Ministry of Science and ICT (MSIT)] (2021-0-00903)
  • Development of Physical Channel Vulnerability-based Attacks and its Countermeasures for Reliable On-Device Deep Learning Accelerator Design
  • National Research Foundation of Korea
  • Korea government (2022R1A4A1033600)
Topics
  • Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
  • Physical Sciences › Computer Science › Hardware and Architecture › Network Packet Processing and Optimization
  • Physical Sciences › Computer Science › Artificial Intelligence › Internet Traffic Analysis and Secure E-voting
Keywords
intrusion detection, automotive Ethernet, in-vehicle networks, wavelet transform, convolutional neural networks, network traffic anomaly detection, attack scenarios, automotive network security

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review