CONTROLLER AREA NETWORK (CAN) DEEP PACKET...
Transcript of CONTROLLER AREA NETWORK (CAN) DEEP PACKET...
![Page 1: CONTROLLER AREA NETWORK (CAN) DEEP PACKET INSPECTIONon-demand.gputechconf.com/gtc/2018/presentation/s8347-anomaly... · CONTROLLER AREA NETWORK (CAN) DEEP PACKET INSPECTION. Car Hacking](https://reader030.fdocuments.net/reader030/viewer/2022041104/5f041c8f7e708231d40c5fd8/html5/thumbnails/1.jpg)
Görkem Batmaz, Systems Engineer
Ildikó Pete, Systems Engineer
28th March, 2018
CONTROLLER AREA NETWORK (CAN) DEEP PACKET INSPECTION
![Page 2: CONTROLLER AREA NETWORK (CAN) DEEP PACKET INSPECTIONon-demand.gputechconf.com/gtc/2018/presentation/s8347-anomaly... · CONTROLLER AREA NETWORK (CAN) DEEP PACKET INSPECTION. Car Hacking](https://reader030.fdocuments.net/reader030/viewer/2022041104/5f041c8f7e708231d40c5fd8/html5/thumbnails/2.jpg)
Car Hacking
2014 Jeep Cherokee (remote attack)Engage brakes, Take control of steering
“Immediatelymy accelerator stopped working. As I
frantically pressed the pedal and watched the RPMs
climb, the Jeep lost half its speed, then slowed to
a crawl.” (Andy Greenberg, Wired)
![Page 3: CONTROLLER AREA NETWORK (CAN) DEEP PACKET INSPECTIONon-demand.gputechconf.com/gtc/2018/presentation/s8347-anomaly... · CONTROLLER AREA NETWORK (CAN) DEEP PACKET INSPECTION. Car Hacking](https://reader030.fdocuments.net/reader030/viewer/2022041104/5f041c8f7e708231d40c5fd8/html5/thumbnails/3.jpg)
3
▪ Connectivity in Modern Vehicles▪ Controller Area Network (CAN)
Vulnerabilities
AUTOMOTIVE SECURITY CAN ATTACKS
▪ Data▪ Approach
CAN ANOMALY DETECTOR
▪ Discussion of Results
RESULTS & CONCLUSIONS
▪ Attack Types▪ Detection & Prevention
Agenda
![Page 4: CONTROLLER AREA NETWORK (CAN) DEEP PACKET INSPECTIONon-demand.gputechconf.com/gtc/2018/presentation/s8347-anomaly... · CONTROLLER AREA NETWORK (CAN) DEEP PACKET INSPECTION. Car Hacking](https://reader030.fdocuments.net/reader030/viewer/2022041104/5f041c8f7e708231d40c5fd8/html5/thumbnails/4.jpg)
4
CAN AttacksAutomotive Security
CAN Attacks
CAN Anomaly Detector Results and Conclusions
CAN Anomaly Detector Results & Conclusions
Increasing Complexity & functionality
Figure1. Some connections of a modern car
1
2
Interconnectedness
Vehicle to Vehicle
Communication
Engine Control Unit
Transmission Control
Unit
Infotainment
TPMS OBD-II
Telematics
Internet
![Page 5: CONTROLLER AREA NETWORK (CAN) DEEP PACKET INSPECTIONon-demand.gputechconf.com/gtc/2018/presentation/s8347-anomaly... · CONTROLLER AREA NETWORK (CAN) DEEP PACKET INSPECTION. Car Hacking](https://reader030.fdocuments.net/reader030/viewer/2022041104/5f041c8f7e708231d40c5fd8/html5/thumbnails/5.jpg)
Controller Area Network (CAN) Security
![Page 6: CONTROLLER AREA NETWORK (CAN) DEEP PACKET INSPECTIONon-demand.gputechconf.com/gtc/2018/presentation/s8347-anomaly... · CONTROLLER AREA NETWORK (CAN) DEEP PACKET INSPECTION. Car Hacking](https://reader030.fdocuments.net/reader030/viewer/2022041104/5f041c8f7e708231d40c5fd8/html5/thumbnails/6.jpg)
6
CAN AttacksAutomotive Security CAN Anomaly Detector Results & Conclusions
Message types: Information,
Diagnostic
Message exchange: Broadcast
Message-based protocol, no addressing
Arbitration method to
resolve priorities
CAN Characteristics
Figure2. The CAN network
![Page 7: CONTROLLER AREA NETWORK (CAN) DEEP PACKET INSPECTIONon-demand.gputechconf.com/gtc/2018/presentation/s8347-anomaly... · CONTROLLER AREA NETWORK (CAN) DEEP PACKET INSPECTION. Car Hacking](https://reader030.fdocuments.net/reader030/viewer/2022041104/5f041c8f7e708231d40c5fd8/html5/thumbnails/7.jpg)
7
CAN Attacks
CAN Vulnerabilities
Automotive Security
CAN Anomaly Detector Results and Conclusions
CAN Anomaly Detector Results & Conclusions
Authenticity Lack of sender authentication Masquerading
Availability Arbitration rules (high priority messages) Denial of Service
Non Repudiation No mechanisms to prove an ECU sent or received a message
Confidentiality Every message sent on CAN is broadcast to every node Eavesdropping
![Page 8: CONTROLLER AREA NETWORK (CAN) DEEP PACKET INSPECTIONon-demand.gputechconf.com/gtc/2018/presentation/s8347-anomaly... · CONTROLLER AREA NETWORK (CAN) DEEP PACKET INSPECTION. Car Hacking](https://reader030.fdocuments.net/reader030/viewer/2022041104/5f041c8f7e708231d40c5fd8/html5/thumbnails/8.jpg)
8
CAN AttacksAutomotive Security
CAN Anomaly Detector
CAN Anomaly Detector Results & Conclusions
Most Critical Attack Types on CAN
REPLAY
Replace message contents
with some pre-recorded
values
INJECTION
Inject false messages
appearing to be
legitimate
DOS
Flood the network
![Page 9: CONTROLLER AREA NETWORK (CAN) DEEP PACKET INSPECTIONon-demand.gputechconf.com/gtc/2018/presentation/s8347-anomaly... · CONTROLLER AREA NETWORK (CAN) DEEP PACKET INSPECTION. Car Hacking](https://reader030.fdocuments.net/reader030/viewer/2022041104/5f041c8f7e708231d40c5fd8/html5/thumbnails/9.jpg)
9
CAN Attacks
Detection & Prevention
Automotive Security
CAN Attacks
CAN Anomaly Detector Results and Conclusions
CAN Anomaly Detector Results & Conclusions
ANOMALY DETECTIONANOMALY DETECTIONOver-the-air updates A N T I - M A LWA R E
Tam
per
dete
cti
on
Secure boot
Device identification
C RY P TO G R A P H I C S E RV I C E S
ECU software integrity
![Page 10: CONTROLLER AREA NETWORK (CAN) DEEP PACKET INSPECTIONon-demand.gputechconf.com/gtc/2018/presentation/s8347-anomaly... · CONTROLLER AREA NETWORK (CAN) DEEP PACKET INSPECTION. Car Hacking](https://reader030.fdocuments.net/reader030/viewer/2022041104/5f041c8f7e708231d40c5fd8/html5/thumbnails/10.jpg)
10
CAN AttacksAutomotive Security
CAN Attacks
Results and Conclusions
CAN Anomaly Detector Results & Conclusions
Anomaly Detection
Finding unusual patterns in data that do not conform to expected behavior
E.g. fraud detection
![Page 11: CONTROLLER AREA NETWORK (CAN) DEEP PACKET INSPECTIONon-demand.gputechconf.com/gtc/2018/presentation/s8347-anomaly... · CONTROLLER AREA NETWORK (CAN) DEEP PACKET INSPECTION. Car Hacking](https://reader030.fdocuments.net/reader030/viewer/2022041104/5f041c8f7e708231d40c5fd8/html5/thumbnails/11.jpg)
11
CAN AttacksAutomotive Security
CAN Attacks
CAN Anomaly Detector Results and Conclusions
CAN Anomaly Detector Results & Conclusions
Point
Anomaly
Collective
Anomaly
Contextual
(Conditional)
Anomaly
E.g. vehicle
speed is 500
miles/hour
E.g. vehicle
speed is 80
miles/hour &
steering wheel
angle is 90
degrees
E.g. vehicle
speed changes
from 50
miles/hour to
80 miles/hour
in less than X
seconds
Types of Anomalies
![Page 12: CONTROLLER AREA NETWORK (CAN) DEEP PACKET INSPECTIONon-demand.gputechconf.com/gtc/2018/presentation/s8347-anomaly... · CONTROLLER AREA NETWORK (CAN) DEEP PACKET INSPECTION. Car Hacking](https://reader030.fdocuments.net/reader030/viewer/2022041104/5f041c8f7e708231d40c5fd8/html5/thumbnails/12.jpg)
12
Controller Area Network (CAN) Security
Controller Area Network (CAN) Anomaly Detector
![Page 13: CONTROLLER AREA NETWORK (CAN) DEEP PACKET INSPECTIONon-demand.gputechconf.com/gtc/2018/presentation/s8347-anomaly... · CONTROLLER AREA NETWORK (CAN) DEEP PACKET INSPECTION. Car Hacking](https://reader030.fdocuments.net/reader030/viewer/2022041104/5f041c8f7e708231d40c5fd8/html5/thumbnails/13.jpg)
13
Detect security-related CAN network anomalies resulting from malicious activitiesAttacks: Injection, ReplayAnomalies: Contextual
CAN AttacksAutomotive Security CAN Anomaly Detector Results & Conclusions
![Page 14: CONTROLLER AREA NETWORK (CAN) DEEP PACKET INSPECTIONon-demand.gputechconf.com/gtc/2018/presentation/s8347-anomaly... · CONTROLLER AREA NETWORK (CAN) DEEP PACKET INSPECTION. Car Hacking](https://reader030.fdocuments.net/reader030/viewer/2022041104/5f041c8f7e708231d40c5fd8/html5/thumbnails/14.jpg)
14
CAN AttacksAutomotive Security
CAN Attacks
CAN Anomaly Detector
CAN Anomaly Detector Results & Conclusions
CAN Frame
DataStart
of
Frame
CAN ID RTR End of
Frame
Control CRC ACK
1 bit 11 or 29
bits1 bit 6 bits 0-64 bits 16 bits 2 bits 7 bits
CAN Message
![Page 15: CONTROLLER AREA NETWORK (CAN) DEEP PACKET INSPECTIONon-demand.gputechconf.com/gtc/2018/presentation/s8347-anomaly... · CONTROLLER AREA NETWORK (CAN) DEEP PACKET INSPECTION. Car Hacking](https://reader030.fdocuments.net/reader030/viewer/2022041104/5f041c8f7e708231d40c5fd8/html5/thumbnails/15.jpg)
15
CAN AttacksAutomotive Security
CAN Attacks
Results and Conclusions
CAN Anomaly Detector Results & Conclusions
The Dataset: BB8 CAN flow
Timestamp MessageID Length PAYLOAD
BYTE 0
BYTE 1
BYTE 2
BYTE 3
BYTE 4
BYTE 5
BYTE 6
BYTE 7
574165791302335 101 8 143 4 140 4 160 4 155 4 W-Speed
574165791302421 102 8 3 254 55 254 15 254 15 254 SUSPENSION
574165791302432 103 4 1 0 252 255 0 0 0 0 ROLL&YAW
574165791302441 104 6 223 255 247 255 223 3 0 0 ACCELERATION
![Page 16: CONTROLLER AREA NETWORK (CAN) DEEP PACKET INSPECTIONon-demand.gputechconf.com/gtc/2018/presentation/s8347-anomaly... · CONTROLLER AREA NETWORK (CAN) DEEP PACKET INSPECTION. Car Hacking](https://reader030.fdocuments.net/reader030/viewer/2022041104/5f041c8f7e708231d40c5fd8/html5/thumbnails/16.jpg)
16
CAN Attacks
Constraints
Automotive Security
CAN Attacks
CAN Anomaly Detector Results & Conclusions
Solutions
Power/Performance Recurrent Neural Networks (RNNs)
Multiple ECUs on the
CAN BUSMessage ID Selection
Unstructured Data Content Extraction
![Page 17: CONTROLLER AREA NETWORK (CAN) DEEP PACKET INSPECTIONon-demand.gputechconf.com/gtc/2018/presentation/s8347-anomaly... · CONTROLLER AREA NETWORK (CAN) DEEP PACKET INSPECTION. Car Hacking](https://reader030.fdocuments.net/reader030/viewer/2022041104/5f041c8f7e708231d40c5fd8/html5/thumbnails/17.jpg)
17
CAN AttacksAutomotive Security CAN Anomaly Detector Results & Conclusions
Security Solution
2nd NN
Message ID
selector &
Content
Extractor
CAN Anomaly Detector
Policy
Handler
1st NNs
Contextual Anomaly Detection
Stage 2 Detection
Output: Probability of
an attack
Errors
CAN BUSCAN
Firewall
![Page 18: CONTROLLER AREA NETWORK (CAN) DEEP PACKET INSPECTIONon-demand.gputechconf.com/gtc/2018/presentation/s8347-anomaly... · CONTROLLER AREA NETWORK (CAN) DEEP PACKET INSPECTION. Car Hacking](https://reader030.fdocuments.net/reader030/viewer/2022041104/5f041c8f7e708231d40c5fd8/html5/thumbnails/18.jpg)
18
CAN AttacksAutomotive Security
CAN Attacks
CAN Anomaly Detector Results & Conclusions
Recurrent Neural Network (RNN)
Input Output
Hidden
![Page 19: CONTROLLER AREA NETWORK (CAN) DEEP PACKET INSPECTIONon-demand.gputechconf.com/gtc/2018/presentation/s8347-anomaly... · CONTROLLER AREA NETWORK (CAN) DEEP PACKET INSPECTION. Car Hacking](https://reader030.fdocuments.net/reader030/viewer/2022041104/5f041c8f7e708231d40c5fd8/html5/thumbnails/19.jpg)
19
CAN AttacksAutomotive Security
CAN Attacks
CAN Anomaly Detector Results & Conclusions
Input t0 Input t1 Input t2 Input t3
Hidden t1 Hidden t2 Hidden t3Hidden t0
Recurrent Neural Network (RNN)
Output
![Page 20: CONTROLLER AREA NETWORK (CAN) DEEP PACKET INSPECTIONon-demand.gputechconf.com/gtc/2018/presentation/s8347-anomaly... · CONTROLLER AREA NETWORK (CAN) DEEP PACKET INSPECTION. Car Hacking](https://reader030.fdocuments.net/reader030/viewer/2022041104/5f041c8f7e708231d40c5fd8/html5/thumbnails/20.jpg)
20
Long Short Term Memory Cell (LSTM)
Forget gate>
Sigmoid
Input Gate>
Sigmoid
Output gate>
Sigmoid
C
CAN AttacksAutomotive Security CAN Anomaly Detector Results & Conclusions
Memory (t-1)
Forget Input Cell Output
CAN BUS Input (t)
Hidden (t-1)Hidden(t)
CAN BUS Input (t+1)
Memory (t)
Next
Step
![Page 21: CONTROLLER AREA NETWORK (CAN) DEEP PACKET INSPECTIONon-demand.gputechconf.com/gtc/2018/presentation/s8347-anomaly... · CONTROLLER AREA NETWORK (CAN) DEEP PACKET INSPECTION. Car Hacking](https://reader030.fdocuments.net/reader030/viewer/2022041104/5f041c8f7e708231d40c5fd8/html5/thumbnails/21.jpg)
21
CAN AttacksAutomotive Security CAN Anomaly Detector Results & Conclusions
LSTM
CELL
DENSE
LAYER
OUTPUT
LSTM
CELL
OUTPUTDENSE
LAYER
…………..
Dense Layer
![Page 22: CONTROLLER AREA NETWORK (CAN) DEEP PACKET INSPECTIONon-demand.gputechconf.com/gtc/2018/presentation/s8347-anomaly... · CONTROLLER AREA NETWORK (CAN) DEEP PACKET INSPECTION. Car Hacking](https://reader030.fdocuments.net/reader030/viewer/2022041104/5f041c8f7e708231d40c5fd8/html5/thumbnails/22.jpg)
22
CAN AttacksAutomotive Security
Results and Conclusions
CAN Anomaly Detector Results & Conclusions
Contextual Anomaly Detection Work Flow
Inference
Training
(Titan X)
Custom error metric
ModelHDF
Hyperparameters
Pre-Processing
Binary
Err
ors
Input for Second Stage
![Page 23: CONTROLLER AREA NETWORK (CAN) DEEP PACKET INSPECTIONon-demand.gputechconf.com/gtc/2018/presentation/s8347-anomaly... · CONTROLLER AREA NETWORK (CAN) DEEP PACKET INSPECTION. Car Hacking](https://reader030.fdocuments.net/reader030/viewer/2022041104/5f041c8f7e708231d40c5fd8/html5/thumbnails/23.jpg)
23
CAN AttacksAutomotive Security
Results and Conclusions
CAN Anomaly Detector Results & Conclusions
Contextual Anomaly Detection Work Flow-2nd Stage
Inference
Training
(Titan X)
ModelHDF
Hyperparameters
Probability of an Attack
Errors from 1st
NNs
![Page 24: CONTROLLER AREA NETWORK (CAN) DEEP PACKET INSPECTIONon-demand.gputechconf.com/gtc/2018/presentation/s8347-anomaly... · CONTROLLER AREA NETWORK (CAN) DEEP PACKET INSPECTION. Car Hacking](https://reader030.fdocuments.net/reader030/viewer/2022041104/5f041c8f7e708231d40c5fd8/html5/thumbnails/24.jpg)
24
CAN AttacksAutomotive Security CAN Anomaly Detector Results & Conclusions
NVIDIA GPU
TITAN XHyperparameters
DATA SOURCE
CAN DATA
FRAMEWORKS
Keras
TensorFlow
Training Architecture
Model
![Page 25: CONTROLLER AREA NETWORK (CAN) DEEP PACKET INSPECTIONon-demand.gputechconf.com/gtc/2018/presentation/s8347-anomaly... · CONTROLLER AREA NETWORK (CAN) DEEP PACKET INSPECTION. Car Hacking](https://reader030.fdocuments.net/reader030/viewer/2022041104/5f041c8f7e708231d40c5fd8/html5/thumbnails/25.jpg)
25
CAN AttacksAutomotive Security CAN Anomaly Detector Results & Conclusions
Model
DATA SOURCE
CAN FLOW
FRAMEWORK
Production Architecture
Probability of
an Attack
TensorRT
NVIDIA DRIVE
GPU
![Page 26: CONTROLLER AREA NETWORK (CAN) DEEP PACKET INSPECTIONon-demand.gputechconf.com/gtc/2018/presentation/s8347-anomaly... · CONTROLLER AREA NETWORK (CAN) DEEP PACKET INSPECTION. Car Hacking](https://reader030.fdocuments.net/reader030/viewer/2022041104/5f041c8f7e708231d40c5fd8/html5/thumbnails/26.jpg)
Model Evaluation
Using Sensitivity & Specificity
True Positives (Anomalies) caught
True Negatives allowed
![Page 27: CONTROLLER AREA NETWORK (CAN) DEEP PACKET INSPECTIONon-demand.gputechconf.com/gtc/2018/presentation/s8347-anomaly... · CONTROLLER AREA NETWORK (CAN) DEEP PACKET INSPECTION. Car Hacking](https://reader030.fdocuments.net/reader030/viewer/2022041104/5f041c8f7e708231d40c5fd8/html5/thumbnails/27.jpg)
27
RESULTS
X axis: Deviation
Y axis: Frequency of errors
Median of Positives: 7.82
Median of Negatives: 0.04
Figure 3. Histogram – Error values output by the 2nd NN
CAN AttacksAutomotive Security CAN Anomaly Detector Results & Conclusions
![Page 28: CONTROLLER AREA NETWORK (CAN) DEEP PACKET INSPECTIONon-demand.gputechconf.com/gtc/2018/presentation/s8347-anomaly... · CONTROLLER AREA NETWORK (CAN) DEEP PACKET INSPECTION. Car Hacking](https://reader030.fdocuments.net/reader030/viewer/2022041104/5f041c8f7e708231d40c5fd8/html5/thumbnails/28.jpg)
28
RESULTS
➢ Sensitivity: 0.87
➢ Specificity: 0.94
X axis: Deviation
Y axis: Frequency of errors
CAN AttacksAutomotive Security CAN Anomaly Detector Results & Conclusions
Figure 4. Histogram – Error values output by the 2nd NN
![Page 29: CONTROLLER AREA NETWORK (CAN) DEEP PACKET INSPECTIONon-demand.gputechconf.com/gtc/2018/presentation/s8347-anomaly... · CONTROLLER AREA NETWORK (CAN) DEEP PACKET INSPECTION. Car Hacking](https://reader030.fdocuments.net/reader030/viewer/2022041104/5f041c8f7e708231d40c5fd8/html5/thumbnails/29.jpg)
29
DISCUSSIONInjection attacks
Total: 37
Detected: 32
Replay attacks
Total: 42
Detected: 37
CAN AttacksAutomotive Security CAN Anomaly Detector Results & Conclusions
Results Per Attack Type
![Page 30: CONTROLLER AREA NETWORK (CAN) DEEP PACKET INSPECTIONon-demand.gputechconf.com/gtc/2018/presentation/s8347-anomaly... · CONTROLLER AREA NETWORK (CAN) DEEP PACKET INSPECTION. Car Hacking](https://reader030.fdocuments.net/reader030/viewer/2022041104/5f041c8f7e708231d40c5fd8/html5/thumbnails/30.jpg)
30
DISCUSSION
A wall between Autonomous-Driving Software and the unsecured
CAN-BUS
Low inference computational cost
Fast response
Offline training
Future Work
CAN AttacksAutomotive Security CAN Anomaly Detector Results & Conclusions
Conclusion
![Page 31: CONTROLLER AREA NETWORK (CAN) DEEP PACKET INSPECTIONon-demand.gputechconf.com/gtc/2018/presentation/s8347-anomaly... · CONTROLLER AREA NETWORK (CAN) DEEP PACKET INSPECTION. Car Hacking](https://reader030.fdocuments.net/reader030/viewer/2022041104/5f041c8f7e708231d40c5fd8/html5/thumbnails/31.jpg)
THANK YOU
QUESTIONS?
![Page 32: CONTROLLER AREA NETWORK (CAN) DEEP PACKET INSPECTIONon-demand.gputechconf.com/gtc/2018/presentation/s8347-anomaly... · CONTROLLER AREA NETWORK (CAN) DEEP PACKET INSPECTION. Car Hacking](https://reader030.fdocuments.net/reader030/viewer/2022041104/5f041c8f7e708231d40c5fd8/html5/thumbnails/32.jpg)
32
References[1] Ivan Studnia, Vincent Nicomette, Eric Alata, Yves Deswarte, Mohamed Kaâniche, Youssef Laarouchi
Survey on security threats and protection mechanisms in embedded automotive networks
Retrieved: https://hal.archives-ouvertes.fr/hal-01176042/document
[2] Automotive Security Best Practices
Retrieved: http://www.mbedlabs.com/2016/01/automotive-can-bus-system-explained.html
[3] Sasan Jafarnejad, Lara Codeca, Walter Bronzi, Raphael Frank, Thomas Engel
A Car Hacking Experiment: When Connectivity meets Vulnerability
[4] Stephen Checkoway, Damon McCoy, Brian Kantor, Danny Anderson, Hovav Shacham, and Stefan Savage
Comprehensive Experimental Analyses of Automotive Attack Surfaces
Retrieved: http://www.autosec.org/pubs/cars-usenixsec2011.pdf
[5] Automtive CAN Bus System Explained
Retrieved: http://www.mbedlabs.com/2016/01/automotive-can-bus-system-explained.html
[6] Charlie Miller, Chris Valasek. Adventures in Automotive Networks and Control Units
Retrieved: http://illmatics.com/car_hacking.pdf
[7] Varun Chandola, Arindam Banarjee, Vipin Kumar
Anomaly Detection: A Survey
Retrieved: http://cucis.ece.northwestern.edu/projects/DMS/publications/AnomalyDetection.pdf
[8] Dhruba K. Bhattacharyya, Jugal Kumar Kalita
Network Anomaly Detection – A machine learning perspective
![Page 33: CONTROLLER AREA NETWORK (CAN) DEEP PACKET INSPECTIONon-demand.gputechconf.com/gtc/2018/presentation/s8347-anomaly... · CONTROLLER AREA NETWORK (CAN) DEEP PACKET INSPECTION. Car Hacking](https://reader030.fdocuments.net/reader030/viewer/2022041104/5f041c8f7e708231d40c5fd8/html5/thumbnails/33.jpg)
33
Images
Figure1. Connections of a modern car
Figure 2. CAN network
Figure 3. Histogram – Error values output by the 2nd NN
Figure 4. Histogram – Error values output by the 2nd NN
![Page 34: CONTROLLER AREA NETWORK (CAN) DEEP PACKET INSPECTIONon-demand.gputechconf.com/gtc/2018/presentation/s8347-anomaly... · CONTROLLER AREA NETWORK (CAN) DEEP PACKET INSPECTION. Car Hacking](https://reader030.fdocuments.net/reader030/viewer/2022041104/5f041c8f7e708231d40c5fd8/html5/thumbnails/34.jpg)
APPENDICES
![Page 35: CONTROLLER AREA NETWORK (CAN) DEEP PACKET INSPECTIONon-demand.gputechconf.com/gtc/2018/presentation/s8347-anomaly... · CONTROLLER AREA NETWORK (CAN) DEEP PACKET INSPECTION. Car Hacking](https://reader030.fdocuments.net/reader030/viewer/2022041104/5f041c8f7e708231d40c5fd8/html5/thumbnails/35.jpg)
Equations in a LSTM Cell – without the dense layer.