Modern in-vehicle networks are shifting towards an Ethernet-based backbone where high bandwidth and low latency can be guaranteed. However, this comes with the cost of exposing the vehicle to more IP-based attacks such as blackholes and denial of service (DoS) attacks. To better secure the in-vehicle network, it is essential to provide efficient monitoring and anomaly detection mechanisms in order to detect such attacks. Software-defined networking (SDN) facilitates these tasks by providing a global view of the underlying network available at the SDN controller. To this end, we propose in this work an anomaly detection solution for SDN-enabled in-vehicle networks. In particular, we use deep learning and network tomography to monitor the network. The deep learning model used in this paper is based on deep autoencoder neural networks. Moreover, network tomography is leveraged so that only a subset of the network is monitored while the remaining can be inferred using the available measurements. We investigate anomaly detection using two types of statistics: flows and ports. We found that the flows' stats outperform the ports' stats in detecting anomalies. Moreover, by only monitoring selected flows, the proposed solution can detect anomalies with an accuracy of up to 99%. In addition, our approach can classify the type of attack, whether it is DoS, SYN flooding, or ARP spoofing attack with only 3% maximum error.

Due to the increased complexity of new in-vehicle networking architectures, which makes direct monitoring of internal network components intractable, alternative solutions are required to tackle this issue. One solution is to leverage the end-to-end measurements to estimate the internal network performance. To this end, we propose to employ network tomography as a monitoring approach for in-vehicle networks. Network tomography can infer the overall network performance by measuring only subset of the network. We investigate the use of network tomography in in-vehicle network by analysing network identifiability of three main architectures: bus-based, central-gateway, and Ethernet-based architectures. Our analysis results indicate the applicability of network tomography in in-vehicle networks based on certain topological and monitors' conditions. Furthermore, we validate our analytical results through simulation which shows a maximum error of only$174\mu s$. Moreover, we compare the proposed approach with one of existing solutions and show that network tomography achieves better bandwidth and latency performance with monitoring overhead saving up to 52.2% and$782.3\mu s$, respectively.