Intrusion Detection Algorithm on Heterogeneous RSUs Based on Behavior Described by Hamming Distance Vector

With the development of 5G technology and the connected road traffic system, the cyber security issues on heterogeneous Road Side Units (RSU) connected to the connected road traffic system are more prominent than before. Though many algorithms were put forward after different kinds of attacks gained worldwide attention, due to the heterogeneity of the RSUs, most RSUs have poor computing power, which makes many algorithms not show enough timeliness on these heterogeneous devices. In order to realize accurate detection on heterogeneous RSUs with poor computing power, this paper proposes a new intrusion detection algorithm that analyzes behaviors from Modbus protocol data flow. The proposed algorithm identifies the abnormities in data flow by computing the behavior vector by calculating the Hamming distance variation on consecutive payloads and classifying them by the K-Shape algorithm. The result shows that with the behavior vector and unsupervised learning, the intrusion detection algorithm takes less computing power and memory space, being workable on zero-day attacks, which is a more suitable method for intrusion detection on heterogeneous RSUs with uneven computing power. Through the evaluation of the algorithm, the detection rate reached 82.7%.