# MDHP-Net: Detecting an Emerging Time-exciting Threat in IVN

arXiv: https://arxiv.org/abs/2411.10258 · HTML: https://mlsanity.com/paper/2411.10258/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 8 of its 61 references that are in the map.
- First posted on arXiv 15 Nov 2024.

## Builds on (most cited first, 8 of 8)

- [GIDS: GAN based Intrusion Detection System for In-Vehicle Network](https://mlsanity.com/paper/1907.07377/) (2019)
- [MAGIC: Detecting Advanced Persistent Threats via Masked Graph Representation Learning](https://mlsanity.com/paper/2310.09831/) (2023)
- [Stimuli-Sensitive Hawkes Processes for Personalized Student Procrastination Modeling](https://mlsanity.com/paper/2102.00089/) (2021)
- [Detection of Message Injection Attacks onto the CAN Bus using Similarity of Successive Messages-Sequence Graphs](https://mlsanity.com/paper/2104.03763/) (2021)
- [Multivariate Hawkes Processes for Large-scale Inference](https://mlsanity.com/paper/1602.08418/) (2016)
- [SOME/IP Intrusion Detection using Deep Learning-based Sequential Models in Automotive Ethernet Networks](https://mlsanity.com/paper/2108.08262/) (2021)
- [Optimal Repair Strategy Against Advanced Persistent Threats Under Time-Varying Networks](https://mlsanity.com/paper/2309.00251/) (2023)
- [SISSA: Real-time Monitoring of Hardware Functional Safety and Cybersecurity with In-vehicle SOME/IP Ethernet Traffic](https://mlsanity.com/paper/2402.14862/) (2024)

## Abstract (arXiv)

The integration of intelligent and connected technologies in modern vehicles, while offering enhanced functionalities through Electronic Control Unit (ECU) and interfaces like OBD-II and telematics, also exposes the vehicle's in-vehicle network (IVN) to potential cyberattacks. Unlike prior work, we identify a new time-exciting threat model against IVN. These attacks inject malicious messages that exhibit a time-exciting effect, gradually manipulating network traffic to disrupt vehicle operations and compromise safety-critical functions. We systematically analyze the characteristics of the threat: dynamism, time-exciting impact, and low prior knowledge dependency. To validate its practicality, we replicate the attack on a real Advanced Driver Assistance System via Controller Area Network (CAN), exploiting Unified Diagnostic Service vulnerabilities and proposing four attack strategies. While CAN's integrity checks mitigate attacks, Ethernet migration (e.g., DoIP/SOME/IP) introduces new surfaces. We further investigate the feasibility of time-exciting threat under SOME/IP. To detect time-exciting threat, we introduce MDHP-Net, leveraging Multi-Dimentional Hawkes Process (MDHP) and temporal and message-wise feature extracting structures. Meanwhile, to estimate MDHP parameters, we developed the first GPU-optimized gradient descent solver for MDHP (MDHP-GDS). These modules significantly improves the detection rate under time-exciting attacks in multi-ECU IVN system. To address data scarcity, we release STEIA9, the first open-source dataset for time-exciting attacks, covering 9 Ethernet-based attack scenarios. Extensive experiments on STEIA9 (9 attack scenarios) show MDHP-Net outperforms 3 baselines, confirming attack feasibility and detection efficacy.