Authors: Thi-Thu-Huong Le, Naufal Suryanto, Aji Teguh Prihatno, Yustus Eko Oktian, Hyoeun Kang, Howon Kim

Abstract: With the increasing reliance on vehicle Controller Area Network (CAN) networks in modern automobiles, ensuring their security against intrusions is of paramount importance. In this paper, we propose a novel approach for intrusion detection and an explanation of in-vehicle CAN networks using Extreme Gradient Boosting (XGBoost) and SHapley Additive exPlanations (SHAP). Our method addresses the challenge of network imbalance and provides both binary class and multiclass classification capabilities. Additionally, it integrates SHAP values to explain the detected intrusions, enhancing the interpretability of the system. We present a comprehensive evaluation of our approach on a published dataset, comparing it with existing literature. The results demonstrate the effectiveness of our method in detecting intrusions with high accuracy. Moreover, the explanations generated by SHAP values provide insights into the factors contributing to the detected intrusions, enabling better understanding and decision-making. The proposed methodology offers a robust and versatile solution for intrusion detection and explanation of in-vehicle CAN networks, bridging the gap between detection accuracy and interpretability. Our work contributes to the field of automotive cybersecurity and provides a foundation for developing more secure and explainable systems in the future.

Conference: WISA 2023 (accepted poster)