# MAXI J$1535-571$ 2017 outburst Seen by INTEGRAL/SPI and Investigating the
Origin of Its Hard Tail

James Rodi INAF - Istituto di Astrofisica e Planetologia Spaziali; via Fosso
del Cavaliere 100; 00133 Roma, Italy  E. Jourdain Université de Toulouse; UPS-
OMP; IRAP; Toulouse, France  CNRS; IRAP; 9 Av. Colonel Roche, BP 44346,
F-31028 Toulouse cedex 4, France  J. P. Roques Université de Toulouse; UPS-
OMP; IRAP; Toulouse, France  CNRS; IRAP; 9 Av. Colonel Roche, BP 44346,
F-31028 Toulouse cedex 4, France

###### Abstract

On 2 September 2017 MAXI J$1535-571$ went into outburst and peaked at $\sim$ 5
Crab in the $2-20$ keV energy range. Early in the flare INTEGRAL performed
Target of Opportunity pointings and monitored the source as it transitioned
from the hard state to the soft state. Using quasi-simultaneous observations
from MAXI/GSC and INTEGRAL/SPI, we studied the temporal and spectral evolution
of MAXI J$1535-571$ in the $2-500$ keV range. Early spectra show a Comptonized
spectrum and a high-energy component dominant above $\sim 150$ keV. CompTT
fits to the SPI data found electron temperatures ($kT_{e}$) evolves from $\sim
31$ keV to 18 keV with a tied optical depth ($\tau\sim 0.85$) or $\tau$
evolving from $\sim 1.2-0.65$ with a tied $kT_{e}$ ($\sim 24$ keV). To
investigate the nature of the high-energy component, we performed a spectral
decomposition of the $100-400$ keV energy band. The CompTT flux varies
significantly during the hard state while the high-energy component flux is
consistent with a constant flux. This result suggests that the two components
originate from different locations, which favors a jet origin interpretation
for the high-energy component over a hybrid corona interpretation. Lastly, two
short rebrightenings during the hard-to-soft transition are compared to
similar events reported in MAXI J$1820+070$.

X-rays: general — X-rays: binaries — Black holes: individual (MAXI
J$1535-571$)

##  1 Introduction

The transient black hole candidate (BHC) MAXI J$1535-571$ went into outburst
on 2 September 2017 (Negoro et al., 2017) and remained active for over a year
with short reflaring events after $\sim 200$ days. Due to its high intensity
and long duration, the source was a frequent target from radio to X-rays.

To date, most results have focused on the X-ray and radio behavior of MAXI
J$1535-571$ with works from AstroSat (Sridhar et al., 2019), Insight-HXMT
(Kong et al., 2020), MAXI/GSC (Nakahira et al., 2018), NICER (Miller et al.,
2018; Cúneo et al., 2020), NuSTAR (Xu et al., 2018), and Swift (Tao et al.,
2018) reporting on the X-ray spectral characteristics and spectral state
transitions during various parts of the outburst and reflaring.

Additional X-ray analyses have investigated the timing behavior and found
type-A, B, and C quasi-periodic oscillations (QPOs) at various points (Huang
et al., 2018; Stevens et al., 2018; Stiele & Kong, 2018; Bhargava et al.,
2019; Mereminskiy et al., 2018; Chatterjee et al., 2021).

Results from radio have mainly explored the transient behavior of the jet
and/or the relationship between the jet and accretion disk (Parikh et al.,
2019; Russell et al., 2019, 2020a; Chauhan et al., 2021). Chauhan et al.
(2019) used radio observations to determine the distance to the source ($\sim
4$ kpc).

Here we propose to focus on the soft gamma-ray ($\gtrsim 100$ keV) behavior.
The origin of this emission in BHs and BHCs in the hard state is debated, but
it can be phenomenologically described as a power-law or a cutoff power-law
model and is observed above the thermal Comptonization component. Proposed
mechanisms include bulk-Comptonization (Laurent & Titarchuk, 1999),
Comptonization of non-thermal electrons (Wardzinski & Zdziarski, 2001),
possibly in a hybrid thermal/non-thermal plasma (Coppi, 1999), and
(synchrotron) jet emission (Laurent et al., 2011).

This high-energy component, sometimes called a “hard tail,” has been observed
in both persistent (Cyg X-1 (Jourdain & Roques, 1994; Cadolle Bel et al.,
2006) and 1E $1740.7-2942$ (Bouchet et al., 2009)) and transient (e.g. V404
Cyg (Jourdain et al., 2017), MAXI J$1820+070$ (Roques & Jourdain, 2019), GRS
$1716-249$ (Bassi et al., 2020)) BH(C)s.

MAXI J$1535-571$ provides an unusual opportunity to study the hard tail,
because the source intensity allowed studying the behavior on the timescale of
a few hours, and also to observe how the evolution compares to other
wavelengths, in particular as the source transitioned from the hard to soft
state. Such a comparison is usually difficult as long exposure times are often
required to detect hard tails or the state transition is not observed with
instruments sensitive to soft gamma-rays.

Table 1: INTEGRAL/SPI observations of MAXI J$1535-571$

INTEGRAL | Time | Time | SPI Exp. | MAXI/GSC Exp.
---|---|---|---|---
Revolution | (UTC) | (MJD) | (ks) | (ks)
1860 | 2017-09-08 12:46:01 $-$ 2017-09-10 16:52:24 | 58004.5319 $-$ 58006.7030 | 116.6 | 6.9
1862 | 2017-09-13 20:42:21 $-$ 2017-09-16 01:42:37 | 58009.8627 $-$ 58012.0712 | 76.7 | 6.3
1863 | 2017-09-16 12:31:36 $-$ 2017-09-18 17:33:00 | 58012.5219 $-$ 58014.7312 | 115.4 | 5.2
1864 | 2017-09-19 07:12:51 $-$ 2017-09-21 03:37:02 | 58015.3005 $-$ 58017.1507 | 130.0 | 3.5
1865 | 2017-09-21 20:09:54 $-$ 2017-09-23 23:19:22 | 58017.8402 $-$ 58019.9717 | 115.4 | 2.2

##  2 Instrument and Observations

The INTErnational Gamma-Ray Astrophysics Laboratory (INTEGRAL) was launched on
17 October 2002 from Baikonur, Kazachstan with an eccentric $\sim 3$-day
orbital period (Jensen et al., 2003). The SPectrometer on-board INTEGRAL (SPI)
covers the $20$ keV $-$ 8 MeV energy range and has an energy resolution of
$2-8$ keV (Roques et al., 2003). INTEGRAL began Target of Opportunity
observations of MAXI J$1535-571$ during INTEGRAL revolutions $1860-1865$
(2017-09-08 12:46:01 $-$ 2017-09-23 23:19:22 UTC). Observations during
revolution 1861 and a part of revolution 1862 suffered from solar activity and
thus could not be used. The remaining data during this period were analyzed
using the SPI Data Analysis Interface (SPIDAI)111Publicly available interface
developed at IRAP to analyze SPI data. Available at
http://sigma-2.cesr.fr/integral/spidai. See description in Burke et al. (2014)
to construct light curves and spectra. The background determination (detector
plane uniformity pattern) is based on empty field observations, temporally
close from the source observation, with an amplitude adjusted on a $3-11$ hr
timescale. The spectra are binned in 35 energy channels in the $25-500$ keV.

The Monitor of All-sky X-ray Image (MAXI) is an experiment onboard the
International Space Station (ISS) (Matsuoka et al., 2009). The Gas Slit Camera
(GSC) instrument covers the $2-30$ keV energy range and can observe $\sim
85\%$ of the sky during an ISS orbit. Due to its large field-of-view, the GSC
detected MAXI J$1535-571$ on 2 September 2017 (Negoro et al., 2017) and was
able to follow the evolution of the source throughout its outburst. However,
here we focused on GSC observations during INTEGRAL revolutions $1860-1865$.
The spectra were generated using the online MAXI/GSC spectral extraction
tool222http://maxi.riken.jp/mxondem/ using the default parameters and were
binned in $192-302$ channels from $2-20$ keV depending on the number of counts
during the observation. The light curve data are from the publicly available
light curves333http://maxi.riken.jp/top/slist.html.

All of the spectra for both instruments have at least 10 counts per bin and
thus can be analyzed using $\chi^{2}$-statistics (Cash, 1979). Time ranges and
exposure times for the SPI and MAXI/GSC observations are listed in Table 1.

Figure 1: Top: MAXI/GSC ($2-4$ keV; red triangles) and Swift/BAT ($15-50$ keV;
purple squares) orbital light curves, together with the $25-50$ keV SPI (black
diamonds) light curve on a 2-scw timescale until $\approx$ MJD 58017, after
which the light curve is on a 5-scw timescale. The SPI $50-100$ keV (Middle)
and $100-400$ keV (Bottom) light curves are show using the same time binning.
The vertical dashed lines in each panel denote state changes based on
(Nakahira et al., 2018) (see text). Quasi-simultaneous MAXI/GSC and SPI
observations have been used to study the spectral behavior of the source.
Figure 2: Top: Time history of GSC ($4-10$ keV)/($2-4$ keV) hardness ratios.
The vertical dashed lines in each panel denote state changes based on
(Nakahira et al., 2018). Middle: Time history of SPI ($50-100$ keV)/($25-50$
keV) hardness ratios. Bottom: Time history of SPI ($100-400$ keV)/($25-50$
keV) hardness ratios. The dashed horizontal lines in each panel are to guide
the eye.

##  3 Analysis and Results

###  3.1 Temporal Behavior

MAXI J$1535-571$ was first detected at 23:55 UT 2 September 2017 (Negoro et
al., 2017). The INTEGRAL ToO began roughly 5 days later. During the first
observations, SPI observed the source at approximately 2 Crab in the $25-50$
keV band. The top panel of Figure 1 shows the $25-50$ keV light curve in black
diamonds on a 2-science window (scw) timescale ($\sim 1800$ s per science
window) until $\sim$ MJD 58018 then a 5-scw timescale, with the orbital
timescale light curves of MAXI/GSC ($2-4$ keV) and Swift/BAT ($15-50$ keV)
overplotted in red triangles and purple squares, respectively. The $1\sigma$
errors are shown in the figure. The dashed vertical lines mark changes in the
spectral states based on Nakahira et al. (2018). Periods ‘Ha’,‘Hb’, and ‘Hc’
are times when the source was in a hard state, but differing behaviors in the
hardness ratios. The ‘S’ period is when the source was in a soft state, and
the ‘T’ period denotes to a transitional period between the hard and soft
states.

We recall that the different spectral states are related to different
accretion states in the system and the relative contributions of thermal
emission from an accretion disk and Comptonized emission from a corona, which
up-scatters photons from the accretion disk (Remillard & McClintock (2006) and
references within). The geometry of the corona is an open question though. In
the hard state (HS), the X-ray spectrum is dominated by the Comptonization
component. In contrast, the thermal component dominates during the soft state
(SS). Between the two states are intermediate states as the system transitions
to the hard and soft states and vice versa.

The different states of the source are reflected in the behavior of its high-
energy emission: From the beginning of the observations until $\sim$ MJD 58015
(i.e. during the hard states), the soft (below $\sim 10$ keV) and hard (above
$\sim 15$ keV X-ray bands evolve independently with the soft X-rays showing a
gradual increase and the hard X-rays with a long, shallow dip. During the
transition, (i.e. after MJD 58015), the two bands show an anti-correlation
with a sharp increase in the soft X-rays followed by a plateau with a
corresponding sharp decrease in the hard X-rays with two rebrightenings during
MJD $58015-58018$ before settling to a roughly, constant flux. The first
rebrightening lasts approximately 0.5 days, and the second lasts roughly 2
days. During both these features, the soft X-ray flux is nearly constant. At
the end of the INTEGRAL observations, the soft state is established, with a
low hard X-ray flux and a strong emission in soft X-rays.

Figure 3: The average spectra for revolutions 1860, 1862$-$1865 in the $2-500$
keV energy range arbitrarily scaled. The model spectra are shown in the inset
without scaling in units of keV2*(photons/cm2/s/keV). For revolutions 1860,
1862, and 1863, the model is Tbabs*Refl*(CompTT)+Cutoff. For revolution 1864,
the model is Tbabs*Refl*(diskbb+CompTT)+Cutoff and for revolution 1865, the
model is Tbabs*(diskbb+po).

The subsequent panels in Figure 2 show the evolution of the hardness ratios
(HR) in the $4-10$ keV$/$$2-4$ keV, $50-100$ keV$/$$25-50$ keV, and $100-400$
keV/$25-50$ keV (respectively). Dashed lines have been added to guide the eye
at 0.85, 0.12, and 0.007, respectively. The vertical dashed lines are again
the state transition from Nakahira et al. (2018). The first portion of both
the $4-10$ keV $/$ $2-4$ keV and $50-100$ keV $/$ $25-50$ keV HR time
histories show a gradual softening that lasts until $\sim$ MJD 58008, based on
the GSC data. In contrast, the $100-400$ keV $/$ $25-50$ keV HR time history
shows the HR are fairly constant during this period.

The MJD $58008-58014$ period, preceding the transition to the soft state, is
characterised by all the considered hardnesses roughly constant. Around MJD
58015, the softening of the X-ray emission is accompanied by a hardening of
the E $>100$ keV emission, while the $25-100$ keV hardness remains unchanged
and will increase 3 days later. After that, HR stay constant again, but with a
configuration opposite to that observed before the transition.

Figure 4: Top: Evolution of optical depth (right) during revolutions 1860,
$1862-1865$ with $kT_{e}=23.9\pm 0.09$ keV and evolution of electron
temperature (left) during revolutions 1860, $1862-1865$ with $\tau=0.85\pm
0.05$. Bottom: Evolution of cutoff power-law normalization during revolutions
1860, $1862-1865$ for a variable electron temperature and fixed optical depth
(left) and for a fixed electron temperature and variable optical depth
(right).

###  3.2 Spectral Behavior

####  3.2.1 Revolution Variability

To start, we carried out fitting of the joint GSC/SPI $2-500$ keV spectra on a
revolution timescale using Xspec. All the best-fit parameter errors are given
at the $1-\sigma$ level. Based on MAXI/GSC results from (Nakahira et al.,
2018), we used $N_{H}=2.6\times 10^{22}\textrm{ cm}^{-2}$ and assumed
abundances and photoionization cross-sections from Wilms et al. (2000).

Absorbed power law (const*tbabs*po) models for revolutions 1860, 1862, and
1863 (all corresponding to the source in the hard state) found photon indexes
of $2.718\pm 0.005$, $2.806\pm 0.008$, and $2.896\pm 0.007$, respectively. The
models were poor fits to the data with $\chi^{2}/\nu$ values of
$4415.70/327=13.5$, $2738.76/334=8.2$, and $2210.53/326=6.8$. In each fit, the
model overpredicts the flux $\sim<4$ keV and $\sim>50$ keV. The high-energy
residuals suggest a cutoff, indicative of Comptonization.

Fitting the spectra to an absorbed cutoff power-law model (const*tbabs*cutoff)
in Xspec, with fixed $N_{H}$) better described the data with $\chi^{2}/\nu$
values of $443.71/324=1.37$ (null hypothesis probability444In Xspec the null
hypothesis is that the observed data are drawn from the model. (NHP)
$=1.1\times 10^{-6}$), $511.45/333=1.53$ (NHP $=1.1\times 10^{-9}$), and
$542.01/325=1.67$ (NHP $=4.3\times 10^{-13}$) for revolutions 1860, 1862, and
1863, respectively. The best-fit parameters for each revolution are
$\Gamma=1.78\pm 0.02$ and $E_{c}=49.6\pm 0.09$ keV, $\Gamma=2.20\pm 0.01$ and
$E_{c}=56.1\pm 1$ keV, and $\Gamma=2.38\pm 0.01$ and $E_{c}=71\pm 2$ keV for
revolutions 1860, 1862, and 1863, respectively. The difference in $\chi^{2}$
values between the power-law and cutoff power-law models gives an estimate of
the significance of the cutoff. A comparison between the models finds
$\Delta\chi^{2}$ values of 3971.99, 2227.31, and 1668.52 for revolutions 1860,
1862, an 1863, respectively. However, the models underpredict the flux
$\sim>100$ keV, which suggests the presence of an additional component above
the cutoff model.

Next, the hard state spectra were fit with a more physically motivated model
using a CompTT model that was convolved with a reflection model (Magdziarz &
Zdziarski, 1995) (assuming abundances from Anders & Grevesse (1989)) and a
broad Fe line, which were reported in Sridhar et al. (2019) and Kong et al.
(2020). The reflection factor was fixed to 1, indicating a disk geometry, and
the energy and width of the line were fixed to 6.5 keV and 0.8 keV,
respectively. The seed photon temperature ($kT_{0}$) was fixed to 0.4 keV
(Kong et al., 2020). The $\chi^{2}/\nu$ values for each fit were
$450.61/323=1.40$ (NHP $=3.3\times 10^{-6}$), $454.47/332=1.37$ (NHP
$=8.8\times 10^{-6}$), and $445.07/324=1.37$ (NHP $=8.9\times 10^{-6}$). As in
the cutoff power-law model, high-energy excesses above $\sim 100$ keV are seen
in the residuals of each spectrum.

Following Roques & Jourdain (2019), we tested the presence of a high energy
tail by adding a cutoff power-law with a photon index fixed to 1.6 and a
cutoff energy fixed to 300 keV, leaving only the normalization free. Including
this component further improved the quality of fit for each of the spectra
with $\chi^{2}/\nu=421.41/322=1.31$ (NHP $=1.6\times 10^{-4}$) for revolution
1860, $\chi^{2}/\nu=392.01/331=1.18$ (NHP $=1.2\times 10^{-2}$) for revolution
1862, and $\chi^{2}/\nu=367.24/323=1.14$ (NHP $=4.5\times 10^{-2}$) for
revolution 1863. We note that revolution 1860 shows the most significant
intra-revolution spectral evolution in the HR plots, which may explain a poor
description obtained for the average spectrum.

To investigate the probability of improvement by chance, we performed an
F-test. For revolution 1860, the probability was $3.5\times 10^{-6}$, for
revolution 1862 the probability was $2.7\times 10^{-12}$, and for revolution
1863 the probability was $3.5\times 10^{-15}$. Thus including the cutoff
component is statistically justified. The best-fit parameters corresponding to
this model are given in Table 2, together with the cross-calibration factor
for the MAXI/GSC instrument relatively to SPI (constant factor fixed to 1).

From MJD 58014 to 58018, Nakahira et al. (2018) found MAXI J$1535-571$ in
clearly a transition between HS and SS, thus disk emission rises during
revolution 1864. So a diskbb model was included in an absorbed power-law model
to account for the emission below $\sim 10$ keV. This results in best-fit
parameters values of $kT_{in}=1.61\pm 0.03$ keV and $\Gamma=3.02\pm 0.01$ with
$\chi^{2}/\nu=306.95/277=1.11$ (NHP $=1.0\times 10^{-1}$). Though the fit is
acceptable, the residuals in the SPI energy range (above $\sim 50$ keV) are
similar to those observed in the power-law fits in the hard state revolutions.
A fit to the SPI data alone using an absorbed power-law model finds a similar
photon index ($3.03\pm 0.01$), but with $\chi^{2}/\nu=56.03/33=1.70$ (NHP
$=7.4\times 10^{-3}$), thus revealing that the SPI data are not well-described
by a power-law. We thus fit the revolution 1864 to the same model as
revolutions 1860, 1862, and 1863 but with a diskbb component with the diskbb
temperature tied to the seed photon temperature. The best-fit parameters are
reported in Table 2. However, the source evolution during this revolution
appears complex with rebrightenings seen in the SPI light curves (Fig. 1) and
variability in the MAXI/GSC hardness ratios (Fig. 2), as well as changes in
the timing behavior (Huang et al., 2018; Stiele & Kong, 2018) during this
period. This limits any conclusion from the analysis of the average spectrum
on an INTEGRAL revolution timescale ($\sim 2$ days). In later analysis, we
investigate the spectral variability on a shorter timescale.

Finally, during revolution 1865, where the source is in a soft state (Nakahira
et al., 2018), the spectrum is well-described by an absorbed diskbb+po model
with $\chi^{2}/\nu=193.93/221=0.88$ (NHP $=9.1\times 10^{-1}$) and flat
residuals. The best-fit parameters are reported in Table 2 as for the previous
revolutions.

Table 2: Revolution Timescale Spectral Parameters

| Const*Tbabs*Refl*(Diskbb+CompTT)+Cutoff555For the cutoff power-law $\Gamma=$ 1.6 and $E_{c}=$ 300 keV. | Const*Tbabs*(Diskbb+Powerlaw)
---|---|---
Rev. | Cross-Normalization | $kT_{in}/kT_{0}$ | $kT_{e}$ | $\tau$ |  | $\chi^{2}/\nu$ | $kT_{in}$ | $\Gamma$ | $\chi^{2}/\nu$
|  | (keV) | (keV) |  |  |  | (keV) |  |
1860 | $1.05\pm 0.02$ | 0.4 (fixed) | $21.4\pm 0.9$ | $1.31\pm 0.06$ |  | 1.31 | $-$ | $-$ | $-$
1862 | $1.12\pm 0.03$ | 0.4 (fixed) | $22\pm 2$ | $0.85\pm 0.09$ |  | 1.18 | $-$ | $-$ | $-$
1863 | $1.18\pm 0.03$ | 0.4 (fixed) | $28\pm 2$ | $0.55\pm 0.07$ |  | 1.14 | $-$ | $-$ | $-$
1864 | $1.22\pm 0.08$ | $0.84\pm 0.03$ | $62\pm 43$ | $0.1\pm 0.2$ |  | 1.22 | $-$ | $-$ | $-$
1865 | $0.98\pm 0.07$ | $-$ | $-$ | $-$ |  | $-$ | $1.15\pm 0.03$ | $2.88\pm 0.02$ | 0.88

The average spectrum for each revolution is shown in Figure 3. They have an
arbitrary normalization for clarity, while the best fits models are displayed
in the inset to better illustrate the evolution of the spectral shape during
the observations. The spectral evolution shows the decreasing significance of
the Comptonization component from revolution 1860 to 1863 with the presence of
a less variable high-energy component above $\sim 100$ keV. The revolution
1864 consists of a disk blackbody component with a weak Comptonization
component and a similar high-energy component. Only two components are
required to describe the source emission at the end of SPI observations,
without it being clear which one of the Comptonized or the power law vanished.

####  3.2.2 Sub-daily Variability

To investigate more in detail the spectral variability of the Comptonized
emission, we built the SPI spectra on a 5-scw timescale ($\sim 5$-hr). Then we
jointly fit the SPI 5-scw spectra from revolutions 1860, 1862$-$1865 using the
reflect*(CompTT)+cutoff model. The evolution of the best-fit parameters with
time are shown in Figure 4. The reflection fraction was fixed to 1, the index
of the cutoff component to 1.6 and the cutoff energy to 300 keV, as above. To
deal with the degeneracy between the two main parameters of the Comptonization
modeling, the electron temperatures ($kT_{e}$) were tied between all the
spectra while the optical depths ($\tau$) were left free. This joint fit
converges to $kT_{e}=23.9\pm 0.9$ keV and indicates that the optical depths
decrease nearly monotonically from roughly 1.2 to 0.65 with a mean error of
$\sim 0.06$ until MJD 58015 (revolution 1864) when the optical depth becomes
nearly constant.

We performed a similar analysis with $kT_{e}$ free and $\tau$ was tied. The
best-fit value for the optical depth is $0.85\pm 0.05$. Like with the optical
depths, we find a downward trend in electron temperature from $\sim 32$ keV to
20 keV and a mean error value of $\sim 1.3$ keV, with the same flattening as
is seen in the changes in optical depth during the observations. Figure 4
shows the evolution of the free parameters (i.e $kT_{e}$ or $\tau$, and cutoff
power-law normalization) with the optical depth variability in the right panel
and the electron temperature variability in the left panel. Both scenarios
produce acceptable results with $\chi^{2}/\nu$ values of $1477.64/1394=1.06$
(NHP =1) and $1519.46/1394=1.09$ (NHP =1), respectively. Interestingly, the
Compton parameters during the rebrightenings between MJD $58015-58017.5$ are
constant. The cutoff normalization values between both models show similar
global behaviors in both scenarios with a mean error of $\sim 0.04$. However,
the normalizations during revolution 1860 are significantly lower when the
optical depths are tied with values of $\sim 0.1$. During the same period, the
normalization values are $\sim 0.25$ when the electron temperature is tied.

In sum, the temporal evolution of the MAXI J$1535-571$ spectra can be thought
of as the corona having a constant electron temperature (or optical depth)
with a decreasing optical depth (or electron temperature) while the system
transitions from the hard state to the soft state observed in revolution 1865.
However, we also remind the reader that for this last revolution the flux is
low and a power law is able to adequately describe those data. Thus fitting
the data with a more complex model results in parameters that are relatively
poorly constrained relative to the other spectra.

##  4 Discussion

###  4.1 Comparison with Other Observations

Insight/HXMT observations in the $2-150$ keV energy range spanned MJD
58002.974 to 58019.920, overlapping with our SPI data. Kong et al. (2020)
fitted their data to a diskbb+cutoff model and found photon indexes increasing
from $\Gamma\sim 1.5$ at the beginning of the observations to $\Gamma\sim 2.9$
at the end of the observations. To compare, we fitted the SPI data in the
$25-100$ keV band on a 5-scw timescale. As shown above (Fig 3), SPI spectra
extend to higher energies, however they show the presence of an additional
component that is not seen in the Insight/HXMT spectra. Therefore, we did not
extend up to 150 keV in the comparison as some spectra have non-negligible
emission from the high-energy component at those energies. The SPI results
(Figure 5) show a similar photon-index evolution. In general the indexes
during MJD 58018 to 58020 are lower than the HXMT values (red triangles in
Figure 5), though the errors on the SPI values are relatively large (and the
cutoff energies are unconstrained), thus in agreement with Kong et al. (2020).

Figure 5: Evolution of photon index using a cutoff model to $25-100$ keV
spectra during SPI observations. The power law indexes from Kong et al. (2020)
are overplotted as red triangles.

###  4.2 Interpretation of Spectral Evolution

At hard X-rays the lower-energy component in the hard state is generally
understood to be from the corona while the origin of the high-energy
component, often referred to a a ‘hard tail,’ is less clear. It can be
phenomenologically modeled as a power law or as cutoff power-law so it is
thought to be non-thermal emission, though occasionally the component is
modeled as an additional thermal Comptonization component (Bouchet et al.,
2009). Early interpretations explained the high-energy emission as arising
from a hybrid thermal/non-thermal Comptonizing plasma (i.e. Coppi (1999)).
Later interpretations explained the component as non-thermal emission related
to the jet seen at radio wavelengths. Polarization detection by INTEGRAL in
the hard tail of Cyg X-1 (Laurent et al., 2011; Jourdain et al., 2012)
strongly supports synchrotron emission from the jet.

Several models, including hybrid Comptonization, have been developed (for
instance eqpair by Coppi (1999)), but they all require a large number of free
parameters, resulting in degenerate parameters. These models are not excluded
by the spectral shape of MAXI J$1535-571$, but they are not conclusive.
However, a correlation between Compton and hard tail components can be used to
discriminate between the jet and hybrid Comptonization models. If their fluxes
are correlated, they likely have a common origin. Conversely, a lack of
correlation between the fluxes from the two components would suggest the
photons originate from different locations.

In an attempt to differentiate between the two scenarios, we investigated the
spectral decomposition of the $100-400$ keV light curve (Figure 6). The plot
shows the CompTT flux (red triangles) varies significantly while the cutoff
power-law flux (green squares) is nearly constant from $\sim$ MJD
$58004-58016$. There is a brief dip lasting $\sim 0.5$ days (MJD
$58015.984-58016.430$) before returning the pre-dip level until MJD 58016.852.
By MJD 58017.914 the total flux (black diamonds) drastically decreased when
the SPI spectrum is just a power law.

To quantify the variability in the cutoff power-law component prior to the
dip, we fit the fluxes between MJD 58005 and 58018.7 to a constant and found a
values of $3.13\pm 0.06\times 10^{-9}$ erg/cm2/s with a
$\chi^{2}/\nu=55.96/28$ (NHP $=1.3\times 10^{-3}$). The lack of significant
variability in the cutoff power-law flux prior to MJD 58016 in contrast to the
CompTT flux evolution (Figure 6) disfavors a same origin for both components.

In the jet scenarios, the soft gamma-ray emission is thought to be produced at
the base of the jet (Zdziarski, 2012), just like some of the IR flux (Russell
& Shahbaz, 2014), while the radio emission comes from far from the BH.
Therefore, looking at infrared observations during the hard state could
provide a more relevant comparison with the hard-tail flux than radio
observations.

Baglio et al. (2018) found a stable IR light curves from MJD $58002-58012$ and
MJD $58017-58029$ with a significant flux decrease between the two periods.
The spectra prior to the gap are consistent with an optically thin synchrotron
emission from a jet.

On another hand, Russell et al. (2019) report that the radio jet began to
quench ($\sim$ MJD 58013.5) and a subsequent likely radio flare occurred
between MJD $58013.5-58017.4$, complicating interpretations of the hard tail
as originating from the jet.

The $100-400$ keV cutoff power-law flux, which finds that the jet flux is not
present by MJD 58017.914, is consistent with IR results from (Baglio et al.,
2018). There were no observations between MJD $58012.103$ and 58017.027 to
assess when the jet emission ended or if there was a corresponding IR dip at
the beginning of MJD 58016, as is seen in the $100-400$ keV flux. However, the
source behavior in the hard X-rays is rather chaotic between $\sim$ MJD 58015
and MJD 58018, with two rebrightenings and a peculiar spectral evolution
pointed out in the hardness evolution. It may be related to the radio
properties.

Figure 7 shows the $100-400$ keV light curve for revolutions $1863-1865$ to
investigate the transition to the soft state. Revolutions $1863-1864$ data are
on a 2-scw timescale, and the revolution 1865 data are on a 5-scw timescale.

We see that by MJD 58016 and then again by MJD 58017, the $100-400$ keV flux
decreased to the same level as MJD $58018-58020$, when the soft state is
established. It may suggest the disappearance / reappearance of jet activity.

Interestingly, we note that Russell et al. (2020b) reported an IR flare ($\sim
4$ days) from the BH transient 4U $1543-47$ suggesting the presence of a
compact jet, though in that case transitioned from the soft state to the SIMS
before returning to the soft state. In MAXI J$1535-571$, the dip seen at the
beginning of MJD 58016 is then perhaps better understood as a failed quenching
of the jet as the nadir of the dip is at similar flux level as revolution
1865, before briefly reforming ($\sim 0.23$ days) and re-quenching.

##  5 Comparison with MAXI J$1820+070$

The BH transient MAXI J$1820+070$ went into outburst in 2018 with INTEGRAL
observations from 16 March to 8 May (MJD $58193-58246$). Due to its
exceptional brightness, it triggered numerous observations and related
interpretation results. Analysis of the SPI data by Roques & Jourdain (2019)
in the $25-1000$ keV energy range found the spectra underwent a similar
evolution to MAXI J$1535-571$ with the Comptonization parameters electron
temperature/optical depth evolving from a high to low before flattening.
However, the MAXI J$1820+070$ spectrum was stable for roughly 40 days compared
to only a few days in MAXI J$1535-571$.

Another similarity is the constancy of the high-energy flux as the hard X-ray
flux decreases while the source was in the hard state. Roques & Jourdain
(2019) did not perform a spectral decomposition of the high-energy flux, but
they did report the cutoff power-law normalization evolution. Their results
found that the normalization stayed at a similar level from the time near the
peak of the burst until the end of the INTEGRAL observations. In contrast, the
CompTT normalization decreases over the same period. Similar behavior was
observed in MAXI J$1535-571$ (Fig. 6).

MAXI J$1820+070$ can provide some understanding of the rebrightenings in MAXI
J$1535-571$. Kara et al. (2019) interpreted early NuSTAR observations of MAXI
J$1820+070$ as arising from a contracting corona while the inner radius of the
accretion disk remained constant. Thus the behavior in MAXI J$1535-571$ during
the transition to the soft state can be thought of as potentially an expanding
and contracting corona.

In another work, Buisson et al. (2021) investigated MAXI J$1820+070$
rebrightenings as due to disruptions of the inner accretion disk that sends
material into the corona. However, they do not propose the mechanism that
causes the disruption in the disk. Alternatively, they point out that the MAXI
J$1820+070$ rebrightening took place $\sim 1$ day after flaring at radio
wavelengths and that the rebrightening is related to the system returning to
equilibrium after the ejection. Interestingly, MAXI J$1535-571$ had flaring at
radio wavelengths before both rebrightenings.

Figure 6: SPI $100-400$ keV 5-scw timescale light curve. The black diamonds
show the total flux. The green squares show the cutoff power-law flux. The red
triangles show the CompTT flux. The best-fit model of a constant to the cutoff
power-law flux is shown as a dashed line. The best-fit model of a constant to
the CompTT flux is shown as a solid line. Figure 7: SPI $100-400$ keV light
curve with revolution $1863-1864$ on a 2-scw timescale and revolution 1865 on
a 5-scw timescale. The dashed line marks the approximate level of the
revolution 1865 flux.

##  6 Conclusion

We analyzed the transient BHC MAXI J$1535-571$ in the $2-500$ keV energy range
over MJD $58004-58020$. During this period, the source peaked at an intensity
of a few Crab, which allowed for studying the temporal and spectral
variability on a timescale of $\sim 5$ hours up to several hundred keV. While
in the hard state, MAXI J$1535-571$ showed $kT_{e}/\tau$ decreasing with time
before flattening in a transition state with a hard-tail component dominant
about $\sim 150$ keV until the source moves to the soft state.

The time evolution of the soft X-ray, hard X-ray, and soft gamma-ray
hardnesses (Fig. 1) show interesting correlations and lack of correlations
during the burst with the soft and hard X-rays evolving similarly until the
transition state while the soft gamma-ray hardness remains mostly unchanged.
When MAXI J$1535-571$ softens in the soft X-rays, the hard X-ray hardness
remains unchanged and the soft gamma-ray hardness increases. Not until the
source is in the soft state does the hard X-ray hardness increase, which is
several days after the soft gamma-rays.

Next, we investigated the spectral decomposition of the $100-400$ keV flux
during the observations to study the possible origin of the hard tail by
looking at how the fluxes for the CompTT and cutoff components evolved. The
fluxes for the two components behaved quite differently with the CompTT flux
decreasing until the source transitions to a soft state while the cutoff flux
is at a constant level until approximately MJD 58016 when a short dip ($<0.5$
days) prior to the soft state.

The Comptonization component is generally agreed to come from a corona while
the origin of the hard tail is less clear. The lack of correlation between the
fluxes (Fig. 6) suggests that the origin of the high-energy component is
different, which supports that it is related to the jet seen at optical/IR and
radio wavelengths.

A detection of polarized emission in soft gamma-rays would provide more
constraints about the origin of the hard tail. Unfortunately, current
instruments are unable to make such measurements for most sources. Recently
launched IXPE will be able to detect polarization, but not above $\sim 10$ keV
(Ratheesh et al., 2021), and so it will not be able to study the high-energy
component. However, broadband observations may give some insight using
capabilities already available. In the case of a jet, the radio and IR
emissions can provide interesting information to inform the high-energy
observations since correlated evolutions are expected.

Additionally, we investigated the spectral behavior of the rebrightening
periods during the transition to the soft state. Similar behavior was observed
in MAXI J$1820+070$ during a transition to the soft state. Such features could
possibly be explained by an expanding/contracting corona (Kara et al., 2019)
or by material sent to the corona after disruptions of the inner accertion
disk (Buisson et al., 2021). A better understanding of this behavior, seen
only at hard X-rays, may provide insight of BH(C)’s during the state
transition.

The research leading to these results has received funding from the European
Union’s Horizon 2020 Programme under the AHEAD2020 project (grant agreement n.
871158). J.R. acknowledges financial support under the INTEGRAL ASI/INAF No.
2019-35.HH.0. The INTEGRAL SPI project has been completed under the
responsibility and leadership of CNES. We are grateful to ASI, CEA, CNES, DLR,
ESA, INTA, NASA and OSTC for support. This research has made use of MAXI data
provided by RIKEN, JAXA and the MAXI team. We thank the referee for the
insightful comments and suggestions.

## References

  * Anders & Grevesse (1989) Anders, E. & Grevesse, N. 1989, Geochim. Cosmochim. Acta, 53, 197. doi:10.1016/0016-7037(89)90286-X
  * Bassi et al. (2020) Bassi, T., Malzac, J., Del Santo, M., et al. 2020, MNRAS, 494, 571. doi:10.1093/mnras/staa739
  * Baglio et al. (2018) Baglio, M. C.; Russell, D. M.; Casella, P. et al. 2018 ApJ, 867, 114B
  * Bhargava et al. (2019) Bhargava, Y., Belloni, T., Bhattacharya, D., et al. 2019, MNRAS, 488, 720. doi:10.1093/mnras/stz1774
  * Bouchet et al. (2009) Bouchet, L., Del Santo, M., Jourdain, E. et al. 2009, ApJ, 693, 1871
  * Buisson et al. (2021) Buisson, D. J. K., Fabian, A. C., Gandhi, P., et al. 2021, MNRAS, 500, 3976. doi:10.1093/mnras/staa3510
  * Burke et al. (2014) Burke, M. J., Jourdain, E., Roques, J. P., & Evans, D. A. 2014, ApJ, 787, 50
  * Cadolle Bel et al. (2006) Cadolle Bel, M., Sizum, P., Goldwurn, A., et al. 2006, A&A, 446, 591
  * Cash (1979) Cash, W. 1979, ApJ, 228, 939. doi:10.1086/156922
  * Chauhan et al. (2019) Chauhan, J., Miller-Jones, J. C. A., Anderson, G. E., et al. 2019, MNRAS, 488, L129. doi:10.1093/mnrasl/slz113
  * Chauhan et al. (2021) Chauhan, J., Miller-Jones, J. C. A., Anderson, G. E., et al. 2021, PASA, 38, e045. doi:10.1017/pasa.2021.38
  * Chatterjee et al. (2021) Chatterjee, D., Debnath, D., Jana, A., et al. 2021, Ap&SS, 366, 82. doi:10.1007/s10509-021-03988-6
  * Coppi (1999) Coppi, P. S. 1999, High Energy Processes in Accreting Black Holes, 161, 375
  * Cúneo et al. (2020) Cúneo, V. A., Alabarta, K., Zhang, L., et al. 2020, MNRAS, 496, 1001. doi:10.1093/mnras/staa1606
  * Huang et al. (2018) Huang, Y., Qu, J. L., Zhang, S. N., et al. 2018, ApJ, 866, 122. doi:10.3847/1538-4357/aade4c
  * Jensen et al. (2003) Jensen, P. L., Clausen, K., Cassi, C. et al. 2003, A&A, 411, L7
  * Jourdain & Roques (1994) Jourdain, E., & Roques, J. P. 1994, ApJL, 426, L11
  * Jourdain et al. (2012) Jourdain, E., Roques, J. P., Chauvin, M., & Clark, D. J. 2012, ApJ, 761, 27J
  * Jourdain et al. (2017) Jourdain, E., Roques, J.-P., & Rodi, J. 2017, ApJ, 834, 130. doi:10.3847/1538-4357/834/2/130
  * Kara et al. (2019) Kara, E., Steiner, J. F., Fabian, A. C., et al. 2019, Nature, 565, 198. doi:10.1038/s41586-018-0803-x
  * Kong et al. (2020) Kong, L. D., Zhang, S., Chen, Y. P., Ji, L. et al. 2020, JHEAp, 25, 29K
  * Laurent & Titarchuk (1999) Laurent, P., & Titarchuk, L. 1999, ApJ, 511, 289L
  * Laurent et al. (2011) Laurent, P., Rodriguez, J., Wilms, J., Cadolle Bel, M., Pottschmidt, K., & Grinberg, V. 2011. Science, 332, 438L
  * Magdziarz & Zdziarski (1995) Magdziarz, P. & Zdziarski, A. A. 1995, MNRAS, 273, 837M
  * Matsuoka et al. (2009) Matsuoka, M., Kawasaki, K., Ueno, S., et al. 2009, PASJ, 61, 999. doi:10.1093/pasj/61.5.999
  * Mereminskiy et al. (2018) Mereminskiy, I. A., Grebenev, S. A., Prosvetov, A. V., et al. 2018, Astronomy Letters, 44, 378. doi:10.1134/S106377371806004X
  * Miller et al. (2018) Miller, J. M., Gendreau, K., Ludlam, R. M., et al. 2018, ApJ, 860, L28. doi:10.3847/2041-8213/aacc61
  * Nakahira et al. (2018) Nakahira, S., Shidatsu, M., Makishima, K., et al. 2018, PASJ, 70, 95. doi:10.1093/pasj/psy093
  * Negoro et al. (2017) Negoro, H., Ishikawa, M., Ueno, S. et al. 2017, ATEL 10699
  * Parikh et al. (2019) Parikh, A. S., Russell, T. D., Wijnands, R., et al. 2019, ApJ, 878, L28. doi:10.3847/2041-8213/ab2636
  * Pottschmidt et al. (2008) Pottschmidt, K., Chernyakova, M., Lubiński, P., et al. 2008, The 7th INTEGRAL Workshop, 98
  * Ratheesh et al. (2021) Ratheesh, A., Rubini, A., Marscher, A., et al. 2021, arXiv:2112.01269
  * Remillard & McClintock (2006) Remillard, R. A. & McClintock, J. E. 2006, ARA&A, 44, 49. doi:10.1146/annurev.astro.44.051905.092532
  * Roques & Jourdain (2019) Roques, J.-P., Jourdain, E. 2019, ApJ, 870, 92R
  * Roques et al. (2003) Roques, J. P., Schanne, S., von Kienlin, A. et al. 2003, A&A, 411, L91
  * Russell & Shahbaz (2014) Russell, D. M. & Shahbaz, T. 2014, MNRAS, 438, 2083. doi:10.1093/mnras/stt2330
  * Russell et al. (2020a) Russell, D.T., Casella, Kalemci, & et al. 2020, MNRAS, 495, 182
  * Russell et al. (2020b) Russell, D. M., Casella, P., Kalemci, E., et al. 2020, MNRAS, 495, 182. doi:10.1093/mnras/staa1182
  * Russell et al. (2019) Russell, T. D., Tetarenko, A. J., Miller-Jones, J. C. A., et al. 2019 ApJ, 883, 198R
  * Sridhar et al. (2019) Sridhar, N., Bhattacharyya, S., Chandra, S., Antia, H. M. 2019, MNRAS, 487, 4221D
  * Stevens et al. (2018) Stevens, A. L., Uttley, P., Altamirano, D., et al. 2018, ApJ, 865, L15. doi:10.3847/2041-8213/aae1a4
  * Stiele & Kong (2018) Stiele, H. & Kong, A. K. H. 2018, ApJ, 868, 71. doi:10.3847/1538-4357/aae7d3
  * Tao et al. (2018) Tao, Lian, Chen, YuPeng, Güngör, Can, et al. 2018, MNRAS, 480, 4443
  * Wardzinski & Zdziarski (2001) Wardzinski, G., & Zdziarski, A. A. 2001, MNRAS, 325, 963
  * Wilms et al. (2000) Wilms, J., Allen, A., & McCray, R. 2000, ApJ, 542, 914. doi:10.1086/317016
  * Xu et al. (2018) Xu, Y., Harrison, F. A., García, J. A., et al. 2018, ApJ, 852, L34. doi:10.3847/2041-8213/aaa4b2
  * Zdziarski (2012) Zdziarski, A. A 2012, MNRAS, 422, 1750


#  RX-ADS: Interpretable Anomaly Detection using Adversarial ML for Electric
Vehicle CAN data ††thanks: Identify applicable funding agency here. If none,
delete this.

Chathurika S. Wickramasinghe 1, Daniel L. Marino 1, Harindra S. Mavikumbure 1,
Victor Cobilean1,
Timothy D. Pennington2, Benny J. Varghese2, Craig Rieger2, Milos Manic1
1Virginia Commonwealth University, Richmond, VA, USA
2Idaho National Laboratory, Idaho Falls, Idaho, USA
<EMAIL_ADDRESS><EMAIL_ADDRESS><EMAIL_ADDRESS><EMAIL_ADDRESS>
###### Abstract

Recent year has brought considerable advancements in Electric Vehicles (EVs)
and associated infrastructures/communications. Intrusion Detection Systems
(IDS) are widely deployed for anomaly detection in such critical
infrastructures. This paper presents an Interpretable Anomaly Detection System
(RX-ADS) for intrusion detection in CAN protocol communication in EVs.
Contributions include: 1) window based feature extraction method; 2) deep
Autoencoder based anomaly detection method; and 3) adversarial machine
learning based explanation generation methodology. The presented approach was
tested on two benchmark CAN datasets: OTIDS and Car Hacking. The anomaly
detection performance of RX-ADS was compared against the state-of-the-art
approaches on these datasets: HIDS and GIDS. The RX-ADS approach presented
performance comparable to the HIDS approach (OTIDS dataset) and has
outperformed HIDS and GIDS approaches (Car Hacking dataset). Further, the
proposed approach was able to generate explanations for detected abnormal
behaviors arising from various intrusions. These explanations were later
validated by information used by domain experts to detect anomalies. Other
advantages of RX-ADS include: 1) the method can be trained on unlabeled data;
2) explanations help experts in understanding anomalies and root course
analysis, and also help with AI model debugging and diagnostics, ultimately
improving user trust in AI systems.

###### Index Terms:

Deep Neural Networks, Autoencoders, Unsupervised Learning, Anomaly Detection,
Explainable AI, Interpretability, Electric Vehicles

IDS

    I
ADS

    A
ITS

    I
NN

    N
XAI

    E
CAN

    C
HIDS

    H
GIDS

    G
DoS

    D
OTIDS

    O

##  I Introduction

Electric Vehicles (EVs) are becoming a primary component in Intelligent
Transportation Systems (ITSs) as it decreases fossil fuel consumption and
greenhouse gas emissions, reducing negative environmental impact [1]. In
recent years, there has been a rapid growth in EV infrastructure, expanding to
various areas, including EV manufacturing, charging stations, battery
advancements, electric vehicle supply equipment, and other roadside
infrastructures [2, 3, 4]. Within EV infrastructure, different communication
technologies such as vehicle-to-Vehicle (V2V), Vehicle-to-sensor-board (V2S),
vehicle-to-infrastructure (V2R), vehicle-to-human (V2H), and vehicle-to-
internet (V2I) plays a major role in building resilient operations [5].
Security of these technologies is critical to avoid vulnerabilities such as
DoS attacks, false data injections, spoofing and modification [5, 6].

Intrusion Detection Systems (IDSs) are widely used approaches in critical
infrastructures such as EV infrastructure [7, 8]. The purpose of IDS is to
detect attacks and intruders in communication systems of critical
infrastructure, thus avoiding possible catastrophic failures and economic
losses. For example, in an EV, attacks can cause break malfunction, engine
overheating, control steering issues, and door lock issues, resulting in life-
threatening and catastrophic damages [7]. Not only EVs, other infrastructure
components such as charging stations are prone to severe advanced persistent
threats (APT) such as ransomware and malware [8]. Thus building IDSs has
become a vital component within EV infrastructure.

During the last decade, data-driven machine learning approaches such as Neural
Networks (NNs) have been widely used for building IDSs for various critical
infrastructure settings [9]. There are two main type of IDSs: Signature based
IDS and Anomaly Based IDS [10]. Typically, Anomaly Detection systems (ADSs)
have the advantage of detecting both known attacks and unknowns/new
attacks/abnormalities in the systems [10, 11]. The idea of ADSs is to learn
the normal behavior of a system such that anything outside learned normal
behavior is detected as an anomaly. The majority of ADSs are trained using
only data coming from normal class/behavior. Therefore, it does not require
expensive data labeling process (time-consuming, costly, and requires
expertise in data) [12]. Further, ADSs can be developed with an abundance of
unlabelled data generated in real-world systems. Out of widely used NN
architectures for ADS development, Autoencoders (AE) has gained much
attention. The reasons for this include many advantages of AEs such as in-
build anomaly detection capability, can be trained with unlabelled data,
scalability, feature extraction and dimentionality reduction capability.
Therefore, in this paper, we are developing a AE based ADS.

Trustworthy AI is a widely discussed topic when applying NNs for mission-
critical infrastructures. Despite the performance benefits of NNs, people
hesitate to trust these systems. The main reason for this is the difficulty of
understanding the decision-making process of the AI models, making these
systems black-box models [13]. It is crucial to address these trust-related
issues to build trust between humans and these AI systems. By addressing these
issues, the Trustworthy AI research area has emerged. One main component of
Trustworthy AI is the Explainability or Interpretability of AI systems (XAI).
XAI aims to provide an understanding of black-box models, enabling users to
question and challenge the outcomes of AI systems. It provides many
advantages, including justifying outcomes of AI systems, improving trust on AI
models, model debugging, and diagnosing [14]. Therefore, this paper present an
interpretable ADS developed using AEs.

This paper present the following contributions:

  1. 1.

Feature Extraction: Window based feature engineering approach which uses a
overlapping sliding window of data frames to extract cyber features.

  2. 2.

Anomaly Detection: ResNet AE based Anomaly Detection System Framework:
Framework only used baseline behavior data for learning the normal behavior of
the system, thus any deviation from the baseline are tagged as anomaly.

  3. 3.

Novel Explainable ADS: Explanations for anomalous behaviors by generating
adversarial samples. These explanation helps with understanding anomalous
behavior, understanding the decision making process of AE, and distinguishing
different types of anomalies.

The presented approach was tested on two benchmark datasets which were
provided by the Hacking and Countermeasures Research Laboratory. This approach
was developed for an ongoing effort with Idaho National Laboratory (INL) to
build ADS for an EV charging system (EVCS). Specifically for EVCSs, RX-ADS can
provide multiple advantages, including understanding the root courses of a
given anomaly, allowing domain experts to distinguish different types of
anomalies and common anomaly behaviors, and AI model debugging and
diagnostics. Further, to the best of the authors’ knowledge, no prior research
has been attempted to develop Explainable ADSs for CAN data.

The rest of the paper is organized as follows: Section II provides the
background and related work; Section III presents the interpretable ADS (RX-
ADS); Section IV discusses the experimental setup, results, and discussion,
and finally, Section V concluded the paper.

##  II Background and Related Work

This section first discusses the Data used for training the presented RX-ADS:
CAN, a widely used communication protocol for in-vehicle communication. Then
we discuss the current work on IDSs developed using CAN data. Finally, we
discuss the background of adversarial machine learning and its applications.

###  II-A CAN Protocol

Controller Area Network (CAN) is the most widely used standard bus protocol
for in-vehicle communication. It enables efficient communication between
Electronic Control Units (ECUs). It is a broadcast-based protocol that allows
multi-master communication, and every node can initiate communication to any
other node in the network. Thus, CAN frames do not contain a destination
address unlike other protocols. In CAN protocol, each ECU is able to sends
messages to the vehicle communication network using data frames [6]. ECUs send
frames with their ID number, and the ECU on destination identifies messages by
the sender ID included in the frame. The collision of messages and data is
avoided by comparing the message ID of the node; the highest priority frame
has the lowest ID. CAN is proved to have many advantages, including reducing
wiring cost, low weight, low complexity, and operating smoothly in an
environment where electromagnetic disturbance factors exist [15].

Figure 1: CAN data frame

CAN protocol operates with four main types of frames: the data frame, the
remote frame, the error frame, and the overload frame [15]. Most of the
communication happens using CAN data frame. The structure of the CAN data
frame is presented in Figure 1, which consists of several common fields that
are explained below [15].

  * •

SOF (Start of Frame) - indicates the beginning of the frame.

  * •

Arbitration Field - is composed of message Id and RTR (Remote Transmission
Request) bit. Depending on RTR state the frame will be identified as data or
remote frame. During communication frames are prioritized using the ID of the
frame.

  * •

Control Field - sends the data size

  * •

Data Field - the actual data that node wants to send using a data frame, this
field can have 0-64 bits.

  * •

CRC Field - contains 15-bit checksum that is used for error detection

  * •

Ack Field - is used to acknowledge that a valid CAN farme was received by
sending a dominant state.

  * •

EOF (End of Frame) - indicates the ending of the frame

Figure 2: RX-ADS: Interpretable Anomaly Detection System Framework

###  II-B Anomaly detection using CAN data

Modern vehicles highly rely on ECU communication. Thus CAN has become the
standard protocol for facilitating the data exchange between ECUs. While CAN
protocol has many advantages, it also consists of security flows such as lack
of authentication, vulnerability for various attack vectors, and lack of
encryption technologies [16]. In the last couple of years, there has been a
surge in research addressing security and vulnerabilities of CAN protocol,
most recent work proposes different IDSs methods. This subsection discusses
existing IDS work on CAN data, specifically focusing on neural network methods
and feature extraction techniques.

To develop CAN IDSs, there are four types of feature extraction approaches has
been tested in the literature [16]. First, frequency or time-based features
where timing between CAN frames and sequencing of CAN frame IDs were used for
developing CAN IDSs. In [17], the broadcast time interval for each ID within a
window (a discrete, non-overlapping, contiguous set of CAN frames) of can
frames were calculated. Similar approach has used in [18], where they
calculate the signal co-occurrence time of IDs to calculate the absolute-error
from expectation for identifying intrusions. Second feature extraction
approach is Payload-based approach where message content bits are directly
used for building CAN IDSs [16]. Third approach is Signal based approach where
message content is decoded into signal before feeding into the IDS. For
example in [19], payload bits are encoded before feeding into Neural network
architecture for detection intrusions in CAN. Finally, the forth approach is
Physical side channels where physical attributes such as voltage, temperature
are used to detect intrusions [16, 20]. Other than these four approaches, some
IDSs have developed using rule based methods where characteristic of CAN
communication was encoded into rules for detecting intrusions [16]. The main
drawback of rule based methods is that they require domain knowledge and
manual rule generation, which are challenging and time-consuming tasks.

Neural Network (NN) based CAN IDSs are mainly developed by encoding the
characteristics of CAN communication into a set of features and training NN
algorithms on these extracted sets of features. The features are extracted to
ensure capturing the normal behavior patterns of CAN bus communication apart
from abnormalities. For example, in [19], Long Short Term Memory (LSTM) and
AE-based unsupervised IDS was developed for detecting intrusions. This
architecture consists of a neural network architecture where CAN data from
each ID type is presented to its assigned LSTM. The results of LSTM networks
are aggregated into AE NN. They have tested their approach on Synthetic CAN
data only. A similar approach was used in [21] where they used LSTM for
detecting anomalies. However, they have not aggregated results of multiple
LSTMs using AE. In [22], deep NN-based IDS was presented, which used deep
belief network (DBN) pre-training methods for initial parameter optimization.
This approach is a supervised approach where labeled data was required to
build the IDS. Convolutional Neural Network (CNN) based supervised CAN IDS was
proposed in [23] where they have tested their system on a real CAN data set.
They have directly fed information in CAN frames as features for the training
of CNN.

###  II-C Adversarial Machine Learning

Adversarial samples are generally referred to as malicious input samples
designed to fool machine learning algorithms [24]. These samples are typically
created by adding a slight modification into real data samples, such that the
outcome of a machine learning model for crafted samples will be different than
the real sample [9]. Typically, machine learning models are vulnerable to
these generated adversarial samples, resulting in unintended or incorrect
outcomes. Generally, adversarial samples are generated to maximize the impact
on the model while minimizing the ability to identify the adversarial sample
apart from a real sample. This ensures by keeping the adversarial sample
inside the domain of valid inputs.

Adversarial machine learning has been widely used for exposing vulnerabilities
in critical infrastructures [9]. The positive or negative impact of
adversarial ML depends on the purpose of the use of these samples. For
example, an attacker can use these samples can be used to gain information on
a trained ML model, information on the data set the model trained on, and
attack a model. This results in possible privacy invasion, safety failures,
data corruptions, and model theft [9, 25]. On the other hand, adversarial
machine learning also can be used for improving the performance of machine
learning models. For example, it can be used to eliminate undefined behaviors
of ML models, exploit vulnerabilities, assess model robustness and improve
generalization [9, 25, 26, 27]. This paper uses adversarial ML to interpret
CAN ADS, which helps with interpreting the decision making process of black-
box NN models and help with NN model debugging and diagnostics.

##  III RX-ADS Methodology

This section discusses the development of RX-ADS. First, we extract a set of
cyber features from raw CAN communication data, i.e., converting the raw CAN
data into a data format that can feed into ML algorithms. Then, it trains an
ML model using baseline data, i.e., data that represent the normal behavior of
the system. Then the trained ML model was tested using various abnormal
scenarios. Once it identifies abnormal samples, these samples are modified
using an adversarial approach, i.e., it performs the minimum modification
required to change the anomalous records ($x^{\prime}$) into normal/baseline
records ($x$). The difference between $x$ and $x^{\prime}$ is used to explain
the ADS outputs, illustrating the most relevant features that lead to
anomalous behaviors. The proposed approach is illustrated in Figure 2. The
individual system components are explained below.

TABLE I:  Presented feature extraction method

Algorithm I: Extract features
---
Inputs: Dataset $(X)$, Time window size $(winSize)$, Possible set of signal
IDs $(IDList)$
Outputs: Window features
1: | $startTime=0$
2: |  $listRecords=[]\leftarrow$ = Initialize a list to store window features
3: |  $endTime=TimestampoflastrecordofX\leftarrow$ = Store the last timestamp of the dataset
4: | % Calculating features for each overlapping time window
5: |  while $startTime<endTime$ do
6: |  $windowMessages\leftarrow$ Extract massages from $X$ where timestamp is within range $startTime-(startTime+winSize)$
7: |  $no\\_of\\_records\leftarrow$ Number of messages in $windowMessages$
8: |  $no\\_of\\_ids\leftarrow$ Number of unique IDs in $windowMessages$
9: |  $no\\_of\\_dlc\leftarrow$ Number of unique data length of messages in $windowMessages$
10: |  $time\\_interval\leftarrow$ Minimum/Maximum/Mean timestamp differences of messages in $windowMessages$
11: |  $no\\_of\\_req\\_msgs\leftarrow$ Number of remote frames in $windowMessages$
12: |  $no\\_of\\_res\leftarrow$ Number of response frames in $windowMessages$
13: |  $no\\_of\\_lost\leftarrow$ Number of lost response frames in $windowMessages$
14: |  $ratio\leftarrow$ Number of messages between requests and responses in $windowMessages$ (Minimum, Maximum, Mean)
15: |  $reply\\_time\\_interval\leftarrow$ Minimum/Maximum/Mean timestamp differences of requests and responses in $windowMessages$
16: |  $0000\leftarrow$ Number of high priority messages (ID=0000) in $windowMessages$
17: |  $no\\_XXXX\leftarrow$ Number of messages with $ID=XXXX$ in $windowMessages$
18: |  $payload\\_pX\\_XXXX\leftarrow$ Mean signal values of payload signal $x$ from messages with $ID=XXXX$ in $windowMessages$
19: |  $startTime+=(winSize/2)\leftarrow$ Calculate start time of next window
20: | end while

TABLE II: Feature List  Feature | Description
---|---
no_of_records | Number of CAN messages
no_of_ids | Number of unique CAN message IDs
no_of_dlc | Number of unique CAN message payload lengths
time_interval | Time interval between messages (minimum, maximum and mean)
no_of_req_msgs | Number of request frames
no_of_res | Number of responses
no_of_lost | Number of lost responses
ratio (min, max, mean) | Number of messages between request frame and response frame
instant_reply_count | Number of instant reply messages
reply_time_interval (min, max, mean) | Time difference between request frame and corresponding response frame
high_priority_count/ 0000 | Number of high priority messages
no_XXXX | Number of messages with ID XXXX
payload_P1_XXXX | Mean payload of signal P1 with ID XXXX

###  III-A Feature Engineering

This subsection describes the window-based feature engineering approach where
we generate a set of cyber features from raw CAN frames. The extracted
features are used to feed the ML algorithm for training. This is motivated by
widely used window-based network flow feature extraction methods in industrial
control ADSs [28]. The main goal of this approach is to extract a set of
features using a set of CAN messages within a defined-sized time window. These
features are selected based on the available literature on CAN bus data [29,
6]. The sliding window-based feature extraction algorithm is presented in
Algorithm I in Table I. For each dataset, we used a time window and extracted
features using the CAN data frames within that window. Overlaps between two
windows are kept as half of the window size. In this experiment, window
features are extracted using different time window sizes ($winSize$).

The set of extracted features with their description is presented in Table II.
These features are extracted to represent the fluctuation in normal behavior
in the CAN communication data. All or some of the features are extracted for
each tested dataset. Then, the extracted features were fed into the AE model
for building data-driven ADS.

###  III-B Data-Driven Machine Learning Model

As discussed in the introduction, Autoencoder (AE) NN model was used to learn
the normal/baseline behavior of the system. Specifically, we used deep ResNet
AE (RAE) architecture to avoid possible performance degradation, and easy
parameter optimization [12]. AE has an encoder and decoder, each consisting of
multiple hidden layers. Training of the model consists of two stages, the
encoding stage, and the decoding stage. The encoding stage transforms the
input data into an embedded representation, whereas in the decoding stage, the
embedded representation is reproduced back to the original input record
(reconstruction). Encoding and decoding functions are non-linear
transformation functions; in this experiment, we used a Sigmoid function. The
loss function ($J_{\theta}$) of the AE model is computed using the difference
between the input ($x$) and the reconstruction ($x^{\prime}$). Thus
reconstruction error of the AE is calculated as follows,

$J_{\theta}=\frac{1}{T}\sum_{i=1}^{T}\|x_{i}-x^{\prime}_{i}\|^{2}$ (1)

where $x_{i}$ is the $i$ th input sample, $x^{\prime}_{i}$ is the
reconstruction for $i$th input sample, $\theta$ denotes the set of parameters
of the AE (weights and biases).

During training, AE is trained with data coming from the normal behavior of
the system. Therefore, it only learns the possible normal behaviors of the
system. When unseen records are presented to the trained AE, the amount of
reconstruction error indicates how much the presented data differs from the
learned normal behavior. A threshold value is defined to identify possible
anomalies. The data records were detected as anomalies if the reconstruction
error was higher than the defined threshold value. Thus, given data record
$x_{i}$ is detected as anomaly ( $y=1$) or normal ($y=0$) as follows,

$J_{\theta,i}=\|x_{i}-x^{\prime}_{i}\|^{2}$ (2)
$y=\left\\{\begin{array}[]{cl}1&:\ J_{\theta,i}\geq th\\\ 0&:\
J_{\theta,i}<th\end{array}\right.$ (3)

where $J_{\theta,i}$ is the reconstruction error of $i$th data record, $th$
denotes the threshold value, and $y$ represents predicted label: anomaly or
not. The threshold value is optimized based on the training baseline data,
i.e., the threshold value should capture the baseline data boundary, capturing
the normal behavior fluctuations.

We experimented with different time window sizes and different RAE
architecture. L1 regularized RAE architecture was used as some of the features
can result in data sparsity. Mean squared error was used as the loss function.
A different number of hidden layers sizes were tested, and the paper presents
the best results. We used the proposed feature engineering method to extract a
set of cyber features for all datasets. We divided the baseline/normal data
into two sets (train/test) with a 0.7/0.3 ratio. The data was scaled to the
0-1 range. Once the RAE model is trained with baseline data, the
reconstruction errors on train data were used to define an error threshold by
keeping 99.9999% train data within the defined threshold. The trained RAE’s
(ADS) performance was evaluated using the test baseline data and
abnormal/attack data.

###  III-C Modifying Anomalous Samples: Adversarial Approach

This paper uses adversarial Machine Learning (ML) to understand why a given
sample is detected as an anomaly. Further, these understandings of data
samples are aggregated to understand different scenarios on how they are
different from each other and what feature changes are prominent in each
scenario. Thus, this adversarial ML approach aims to understand the decision
boundary of normal data and to understand how abnormal scenarios affect the
system. This is important for assurance and validation of AI systems.

The concept of adversarial sample generation was used to find the minimum
modification needed to change the anomalous sample into a normal behavior
sample. This is achieved by finding an adversarial sample $x^{\prime\prime}$
that is detected as a normal sample with the given $th$ while minimizing the
distance between real sample $x$ and adversarial/modified sample
$x^{\prime\prime}$.

$\underset{x^{\prime\prime}}{min}\left\|x^{\prime}-x^{\prime\prime}\right\|^{2}$
(4)

$\begin{array}[]{rcl}s.t:J_{\theta,x^{\prime\prime}}\leq th\\\
x_{min}<=x^{\prime\prime}<=x_{max}\\\ \end{array}$ (5)

We constrain the adversarial sample $x^{\prime\prime}$ o be inside the bounds
($x_{min},x_{max}$). These bounds are defined using the training data,
ensuring that the adversarial samples are inside the domain of data
distribution.

###  III-D Interpretable Interface

The presented interpretable interface generates explanations for detected
anomalies. For generating explanations, RX-ADS uses the identified anomalous
samples as references, then uses Eq 4 and 5 to find the adversarial samples
with minimum modifications. Explanation generated under two categories:

  * •

Explanations for individual Anomaly Samples: These explanations are generated
by calculating the difference between the anomaly sample and the closest
adversarial sample ($x-x^{\prime\prime}$) and visualizing it using a bar
chart. This bar chart shows the deviation of the anomaly sample from what the
model learned as normal behavior. Domain experts can analyze these graphs
quantitatively to understand the root courses of a given anomaly. For example,
identifying cyber anomalous behavior which leads to a physical impact in the
vehicle.

  * •

Explanations for global anomalous behavior: Explanations generated for
anomalous data records are aggregated to understand common anomaly behaviors
in the system. It allows domain experts to distinguish different types of
anomalies and common anomaly behaviors.

tying a cyber root cause to a physical impact.

##  IV Experiment, Results, and Discussion

The proposed system was tested against two popular CAN protocol benchmark
datasets. Both datasets contain CAN bus data representing normal behavior and
abnormal/attack behaviors. This section discusses RX-ADS results and
discussion for each dataset.

TABLE III:  OTIDS dataset: RX-ADS anomaly detection comparison with recent literature Approach | Normal Behavior | DoS | Fuzzy
---|---|---|---
HIDS [29] | 100% | 100% | 100%
OCSVM | 99.77% | 100% | 100%
LOF | 99.32% | 100% | 100%
RX-ADS | 100% | 100% | 100%

(a) DoS

(b) Fuzzy

Figure 3: OTIDS dataset: Outcomes generated using adversarial approach for DoS
records and Fuzzy records

###  IV-A RX-ADS vs. HIDS (OTIDS dataset)

This section compares the anomaly detection performance between RX-ADS and
HIDS algorithms. The Histogram-based IDS (HIDS) is the state-of-the-art
approach for detecting intrusions in the OTIDS dataset.

The OTIDS benchmark CAN dataset was released by Hacking and Countermeasures
Research Lab (HCRL) [15]. It contains real CAN data collected from a Kia Soul
vehicle in normal behavior and during a set of attacks: DoS, Fuzzy, and
impersonate. With the release of this dataset, the authors also proposed an
Offset Ratio and Time interval-based Intrusion Detection System (OTIDS). Their
approach uses offset ratio and time interval of remote frame responses to
identify intrusions in CAN communication.

This experiment used baseline, DoS, and Fuzzy data to simplify the experiment
and compare the explanations. DoS Attacks have been implemented by injecting
messages of ‘0x000’ CAN ID in a short cycle. Fuzzy Attacks have been
implemented by injecting messages of spoofed random CAN ID and DATA values.
All the features except $payload\\_PX\\_XXXX$ were extracted for this dataset.
This was performed due to the available domain knowledge on this dataset shows
that it is possible to identify abnormalities by using only remote request and
response-based features. It has to be noticed that this is the only open
dataset with remote frames and responses, such that it is important to
experiment on how this information is essential for anomaly identification.

TABLE IV:  OTIDS dataset: Natural interpretation of abnormal communication compared to normal Characteristics of communication | Normal communication | Abnormal communication (DoS and Fuzzy)
---|---|---
High priority CAN frames with ID 0000 | Low | High
Min/max/mean time interval between remote and response messages | Low | High
| Number of CAN messages between the remote frame and
---
its corresponding response frame (min/max/mean ratio)
Low | High
Higher number of lost response messages | Low | High
Number of instant reply, request, and response messages | High | Low
Number of unique IDs, number of records, and unique DLC values | High | Low

####  IV-A1 Anomaly Detection System Performance

We experimented with different millisecond time window sizes :0.01, 0.02,
0.05, 0.1, 0.2, 0.5, 1, 2, 5. We found that when the time window is too small
($<$0.02), the performance of the fuzzy attack detection rate decreases.
Further, the baseline accuracy was reduced if the time window is too large
(0.1$>$). The best-observed result was observed for 0.05 milliseconds window
size, which is recorded in this section. Table III shows the detection
performance of presented RX-ADS compared to recent state-of-the-art IDSs on
OTIDS dataset: Histogram-based approach (HIDS) presented in [29]. We also
implement two widely used anomaly detection algorithms: Local Outlier Factor
(LOF) and One-Class SVM (OCSVM).

It can be seen that RX-ADS shows comparable performance with the state-of-the-
art approach on this dataset. Both HIDS and RX-ADS used window-based feature
exaction methods. The HIDS uses a fixed number of CAN frames as a window,
whereas RX-ADS uses CAN messages within a fixed time window. It has to be
noted that the HIDS uses the K-Nearest Neighbor (KNN) algorithm for performing
multi-class classification. Thus it requires labeled data from all the classes
(normal, DoS, and Fuzzy) for training. However, RX-ADS only requires data from
normal behavior for training, which is advantageous as the data labeling is
expensive [14, 12]. Further, to the best of our knowledge, none of the IDSs
proposed on this dataset use an explainable approach. It has to be noted that
the goal of this approach is not only to detect anomalies but also to
interpret the reasons behind anomalies (interpret the decision-making process
of black-box AI models).

####  IV-A2 Explanation generation

Figure 3 shows the deviations calculated using the adversarial method for two
types of abnormal/attack behaviors (DoS and Fuzzy). As we discussed before,
these deviations of feature values not only explain the behavior of attacks
compared to normal behavior but also help with distinguishing different types
of attacks. To make the comparison easy, deviations for two types of attacks
were presented with the same scale. Explanations for attack behaviors can be
naturally interpreted as compared to normal behavior in following tabular
format in Table IV.

Related literature on this dataset confirms that the normal communication has
a very low lost reply rate, a higher number of instant reply rates, and a very
low/zero amount of high priority messages. Further, a higher number of
messages during normal communication results in a higher number of unique IDs,
number of records (messages), and unique DLC values. However, during attacks,
it generates high-priority messages or spoofs random messages, resulting in
collisions between CAN frames. It leads to a delay in CAN communication. Thus,
fewer records are expected during abnormal communication compared to baseline.
Further, this results in a fewer number of unique DLCs, IDs, and a number of
records within a window. Thus, the identified features of attacks match the
domain expert’s knowledge of this dataset.

The explanation generated for two types of attacks can be compared against
each other to identify distinguishing characteristics between them. The
explanations for distinguishing two behaviors can be naturally interpreted in
the following manner.

DoS and Fuzzy attacks affects the system differently based on the following
observations:

  * •

DoS result in a higher number of high priority messages (0000), whereas Fuzzy
does not result in high priority messages with ID 0000

  * •

Min/Max/Mean ratio is higher for DoS due to high priority message
communication.

  * •

No of lost response frame rate is higher for DoS.

Once adversarial samples are generated, feature value distribution of
baseline, attacks, and adversarial records also give insights into how
different features behave under abnormalities. Figure 4 illustrates the
feature behavior for selected features under DoS attacks. It can be seen that
many of the identified features deviate from the baseline behavior with
different magnitudes (Orange line). However, generated adversarial samples
(green line) have a much closer feature value distribution than the baseline
(blue line). Feature value distribution during Fuzzy attacks is also presented
in Figure 5, which also shows similar behavior.

(a) no_of_lost (b) no_of_lost

(c) mean_ratio (d) mean_ratio

(e) instant_reply_count (f) instant_reply_count

Figure 4: DoS: Feature value distribution of DoS data and Adversarial data
compared to normal feature value distribution

(a) no_of_lost (b) no_of_lost

(c) mean_ratio (d) mean_ratio

(e) instant_reply_count (f) instant_reply_count

Figure 5: Fuzzy: Feature value distribution of Fuzzy data and Adversarial data
compared to normal feature value distribution

###  IV-B RX-ADS vs. GIDS and HIDS (Car Hacking dataset)

This section compares the anomaly detection performance between RX-ADS with
GIDS and HIDS algorithms. The Generative neural network-based IDS (GIDS) is
the state-of-the-art approach for detecting intrusions in the Car Hacking
dataset.

The Car Hacking dataset is the most recent dataset released by the Hacking and
Countermeasures Research Lab (HCRL). This dataset contains real CAN data
collected from Hyundai YF Sonata. It contains a baseline data file, a data
file with DoS attacks, a data file with Fuzzy attacks, and a data file with
Spoofing attacks. CAN frame structure is very similar compared to their first
released OTIDS dataset. Remote frames indicators are only included in baseline
data; thus, this experiment ignores remote information bit from CAN frames.

In this experiment, we used only baseline, DoS and Fuzzy CAN data. All the
features except payload PX_XXXX were extracted for this dataset. This was
performed due to the available domain knowledge confirming that it is possible
to identify intrusions only using timing information and ID frequencies. This
dataset seems to be the most widely used dataset in the CAN IDS literature
[16]. Initial data analysis indicated large gaps between CAN frames during
attacks [30, 16]. Our analysis also confirmed this behavior. Hence we trimmed
attack datasets before using them for the experimentation.

####  IV-B1 Anomaly Detection System Performance

TABLE V:  Car Hacking Dataset: RX-ADS anomaly detection comparison with recent literature Method | Data | Accuracy | Precision | Recall | F1
---|---|---|---|---|---
HIDS | DoS | 97.28 | 100 | 96.2 | 98.06
Fuzzy | 95.17 | 99.55 | 94.3 | 97.18
GIDS [6] | DoS | 97.9 | 96.8 | 99.6 | 95.42
Fuzzy | 98.0 | 97.3 | 99.5 | 98.39
RX-ADS |  | Baseline
---
Test
100 | - | - | -
DoS | 99.47 | 99.6 | 99.74 | 99.67
Fuzzy | 99.19 | 99.39 | 99.63 | 99.51
TABLE VI:  Car Hacking dataset: Natural interpretation of abnormal communication compared to normal Characteristics of communication | Normal communication | Abnormal communication
---|---|---
DoS | Fuzzy
High priority CAN frames with ID 0000 | Low | High | Low
Odd ID can frames within a window | Low | Highest | High
Min/max/mean time interval between remote and response messages | Low | High | Highest
Number of unique CAN frames within a window | Low | Low | High

(a) DoS

(b) Fuzzy

Figure 6: Car Hacking Dataset: Outcomes generated using adversarial approach
for DoS records and Fuzzy records

We experimented with different millisecond time windows: 0.01, 0.02, 0.03,
0.04, 0.05. When looking at frames within the window, we observed some
differences between normal and attack communication. When the window size is
too small, there are many windows without injected intrusion frames (During
attack communication). However, even without any injected frames, the window
features of CAN frames are different due to the fact that these communication
happens during attacks. Thus, considering these windows as normal windows is
inaccurate. If the time window is too large, the number of records generated
from window based feature extraction decreases. This results in less number of
data records for training. Out of the tested time windows, 0.03 and 0.04
milliseconds gave the best results. The best-observed results were recorded in
this section. Table V shows the detection performance of presented RX-ADS
compared to recent state-of-the-art IDSs on Car hacking dataset: Histogram-
based approach (HIDA) presented in [29] and GIDS presented in [6]. We
calculate Accuracy, precision, recall, and F1 scores for comparison purposes
with available literature.

It can be seen that the anomaly detection rate of RX-ADS is higher for both
DoS and Fuzzy intrusions compared to other approaches. As we discussed before,
RX-ADS has an advantage over the HIDS approach as RX-ADS does not require
labeled data for training. Further, HIDS have implemented different variants
of OCSVM-attack models for each intrusion, whereas RX-ADS only implements one
model. RX-ADS can use aggregated explanations for distinguishing DoS from
Fuzzy intrusions. GIDS is similar to RX-ADS as they only train on normal data.
GIDS requires converting CAN data into image format for training [6]. Thus it
is a complex and expensive pre-processing step compared to the simple window-
based feature extraction used in RX-ADS. The major advantage of RX-ADS is the
model interpretability, making domain experts verify model outcomes and debug
and diagnose when necessary.

Figure 7: Car Hacking Dataset: Outcomes generated using adversarial approach
for normal CAN frame communication during attacks (DoS)

####  IV-B2 Explanation generation

Figure 6 shows the deviations calculated using adversarial approach for two
types of abnormalities (DoS and Fuzzy). It can be seen that some features
highly deviated during abnormal behaviors compared to baseline. Further, there
is a clear difference between the two abnormal behaviors. Explanations for
attack behaviors can be naturally interpreted in the following tabular format
in Table VI.

Compared to baseline, there are more frames with ID 0000 and odd IDs during
DoS attacks. Further, the mean time interval between frames is higher during
DoS attacks. Compared to baseline, a higher number of unique ID frames can be
seen during Fuzzy attacks.

We can also compare the behaviors between two attacks for distinguishing
characteristics. During attack behaviors, both Fuzzy and DoS shows a higher
number of odd ID frames (frame with IDs that have not been encountered during
baseline behavior). However, during DoS, these are mainly are coming from
frames with ID 0000, whereas in Fuzzy, these are not high priority frames.
These are coming from random IDs which haven’t encounter during baseline
behavior. Mean time interval between frames is higher for both compared to
baseline. However, the Fuzzy attack shows the highest mean time interval than
DoS. Number of unique IDs is very high during fuzzy attacks compared to DoS.

Related literature on this dataset confirms the above-discussed behavior. For
example, normal communication has a very low number of high-priority messages.
In addition, the Fuzzy attacks result in CAN frames with random IDs which have
not been encountered during baseline behaviors. During DoS, the number of
high-priority messages with ID 0000 is higher compared to baseline and Fuzzy
attacks. Both attacks result in fewer frames within a time window. This
happens because, during attacks, it generates high-priority messages or spoofs
random messages. These high-priority frames and other attack frames can have
multiple effects, such as packet collisions and paralyzing the functions of a
vehicle resulting in delays or even suspension of other messages [15].
Therefore, the mean time interval between frames is higher compared to the
baseline. These may be due to the CAN frame collisions and paralyzing the
functions of a vehicle resulting in delays, or even suspension of other CAN
messages [15].

Figure 7 shows the explanations generated for normal communication frames,
which are in-between attack behaviors. Even though these samples do not have
injected attack frames, the overall communication pattern of these windows was
significantly different from the baseline. Thus, the error threshold value was
increased to detect these windows as normal windows. This can also be used as
a similar filtering method to detect windows without injected frames within
attacks (a similar filtering approach was proposed in HIDS). These normal
windows during attack communication are expected to be different from baseline
communication as attack behaviors result in pre and post-effects in the
systems, resulting in deviations from the baseline behavior. These deviations
seem to mainly result from higher mean time intervals between frames. Further,
the number of unique IDs and DLC values seems low compared to the baseline.
This matches domain experts’ knowledge: attack communication results in a
latency of CAN frames. These features need to be discussed with domain
experts.

##  V Conclusion

This work presented a ResNet Autoencoder based Explainable Anomaly Detection
System (RX-ADS) for CAN bus communication data. The ResNet Autoencoder model
was used to learn the baseline/normal behavior from the CAN communication
data. The reconstruction error threshold of ResNet Autoencoder was used to
distinguish abnormal behaviors. The explanation generation method uses an
adversarial sample generation approach for identifying the deviation of
abnormal behavior from learned baseline behavior. This is achieved by finding
the minimum modification required to covert abnormal samples to normal
samples. These modifications are used to identify, visualize and explain the
relevant feature behaviors for abnormalities. The approach was tested on two
widely used benchmark CAN datasets released by the Hacking and Countermeasures
Research Lab: OTIDS and Car Hacking.

RX-ADS detected abnormalities in the two benchmark CAN protocol datasets and
showed comparable performance compared to the current work on OTIDS dataset
while outperforming on Car Hacking dataset. Further, the proposed approach is
able to explain the abnormal behaviors of the intrusions matching the expert
knowledge. The relevant features found by the presented approach helped with
distinguishing between different abnormal behaviors. Experimental results
showed that the presented RX-ADS methodology provided insightful and
satisfactory explanations for the selected datasets. Further, to the best of
our knowledge, this is the first attempt at developing an Explainable ADS for
CAN protocol communication.

In future work, the proposed approach will be deployed in a real-world
setting: INL EV Charging System setup. Further, the proposed approach will be
extended to add physical features for providing more holistic abnormal
behavior detection in EV infrastructure.

## Acknowledgements

This work was supported in part by the Department of Energy through the U.S.
DOE Idaho Operations Office under Contract DE-AC07-05ID14517, and in part by
the Commonwealth Cyber Initiative, an Investment in the Advancement of Cyber
Research and Development, Innovation and Workforce Development
(cyberinitiative.org).

## References

  * [1] HAJI Zakaria, MOUNIR Hamid, EL MARJANI Abdellatif and AMARIR Imane  “Recent Advancements and Developments for Electric Vehicle Technology”  In _2019 International Conference of Computer Science and Renewable Energies (ICCSRE)_ , 2019, pp. 1–6  DOI: 10.1109/ICCSRE.2019.8807726
  * [2] Li Zhu et al.  “Big Data Analytics in Intelligent Transportation Systems: A Survey”  In _IEEE Transactions on Intelligent Transportation Systems_ 20.1, 2019, pp. 383–398  DOI: 10.1109/TITS.2018.2815678
  * [3] Juan Guerrero-Ibáñez, Sherali Zeadally and Juan Contreras-Castillo  “Sensor Technologies for Intelligent Transportation Systems”  In _Sensors_ 18.4, 2018  DOI: 10.3390/s18041212
  * [4] Azzedine F. M. Boukerche and Rodolfo W. L. Coutinho  “Crowd Management: The Overlooked Component of Smart Transportation Systems”  In _IEEE Communications Magazine_ 57, 2019, pp. 48–53
  * [5] Yosra Fraiji, Lamia Ben Azzouz, Wassim Trojet and Leila Azouz Saidane  “Cyber security issues of Internet of electric vehicles”  In _2018 IEEE Wireless Communications and Networking Conference (WCNC)_ , 2018, pp. 1–6  DOI: 10.1109/WCNC.2018.8377181
  * [6] Eunbi Seo, Hyun Min Song and Huy Kang Kim  “GIDS: GAN based Intrusion Detection System for In-Vehicle Network”  In _2018 16th Annual Conference on Privacy, Security and Trust (PST)_ , 2018, pp. 1–6  DOI: 10.1109/PST.2018.8514157
  * [7] Moayad Aloqaily, Safa Otoum, Ismaeel Al Ridhawi and Yaser Jararweh  “An intrusion detection system for connected vehicles in smart cities” Recent advances on security and privacy in Intelligent Transportation Systems  In _Ad Hoc Networks_ 90, 2019, pp. 101842  DOI: https://doi.org/10.1016/j.adhoc.2019.02.001
  * [8] Manoj Basnet and Mohd. Hasan Ali  “Deep Learning-based Intrusion Detection System for Electric Vehicle Charging Station”  In _2020 2nd International Conference on Smart Power Internet Energy Systems (SPIES)_ , 2020, pp. 408–413  DOI: 10.1109/SPIES48661.2020.9243152
  * [9] Daniel L. Marino, Chathurika S. Wickramasinghe and Milos Manic  “An Adversarial Approach for Explainable AI in Intrusion Detection Systems”  In _IECON 2018 - 44th Annual Conference of the IEEE Industrial Electronics Society_ , 2018, pp. 3237–3243  DOI: 10.1109/IECON.2018.8591457
  * [10] Ansam Khraisat, Iqbal Gondal, Peter Vamplew and Joarder Kamruzzaman  “Survey of intrusion detection systems: techniques, datasets and challenges”  In _Cybersecurity_ 2, 2019  DOI: 10.1186/s42400-019-0038-7
  * [11] Gisung Kim, Seungmin Lee and Sehun Kim  “A novel hybrid intrusion detection method integrating anomaly detection with misuse detection”  In _Expert Systems with Applications_ 41.4, Part 2, 2014, pp. 1690–1700  DOI: https://doi.org/10.1016/j.eswa.2013.08.066
  * [12] Chathurika S. Wickramasinghe, Daniel L. Marino and Milos Manic  “ResNet Autoencoders for Unsupervised Feature Learning From High-Dimensional Data: Deep Models Resistant to Performance Degradation”  In _IEEE Access_ 9, 2021, pp. 40511–40520  DOI: 10.1109/ACCESS.2021.3064819
  * [13] Chathurika S. Wickramasinghe, Daniel L. Marino, Javier Grandio and Milos Manic  “Trustworthy AI Development Guidelines for Human System Interaction”  In _2020 13th International Conference on Human System Interaction (HSI)_ , 2020, pp. 130–136  DOI: 10.1109/HSI49210.2020.9142644
  * [14] Chathurika S. Wickramasinghe et al.  “Explainable Unsupervised Machine Learning for Cyber-Physical Systems”  In _IEEE Access_ 9, 2021, pp. 131824–131843  DOI: 10.1109/ACCESS.2021.3112397
  * [15] Hyunsung Lee, Seong Hoon Jeong and Huy Kang Kim  “OTIDS: A Novel Intrusion Detection System for In-vehicle Network by Using Remote Frame”  In _2017 15th Annual Conference on Privacy, Security and Trust (PST)_ , 2017, pp. 57–5709  DOI: 10.1109/PST.2017.00017
  * [16] Miki E. Verma et al.  “ROAD: The Real ORNL Automotive Dynamometer Controller Area Network Intrusion Detection Dataset (with a comprehensive CAN IDS dataset survey & guide)”  In _CoRR_ abs/2012.14600, 2020  arXiv: https://arxiv.org/abs/2012.14600
  * [17] Andrew Tomlinson, Jeremy Bryans, Siraj Ahmed Shaikh and Harsha Kumara Kalutarage  “Detection of Automotive CAN Cyber-Attacks by Identifying Packet Timing Anomalies in Time Windows”  In _2018 48th Annual IEEE/IFIP International Conference on Dependable Systems and Networks Workshops (DSN-W)_ , 2018, pp. 231–238  DOI: 10.1109/DSN-W.2018.00069
  * [18] Michael R. Moore et al.  “Modeling Inter-Signal Arrival Times for Accurate Detection of CAN Bus Signal Injection Attacks: A Data-Driven Approach to in-Vehicle Intrusion Detection”  In _Proceedings of the 12th Annual Conference on Cyber and Information Security Research_ , CISRC ’17  Oak Ridge, Tennessee, USA: Association for Computing Machinery, 2017  DOI: 10.1145/3064814.3064816
  * [19] Markus Hanselmann, Thilo Strauss, Katharina Dormann and Holger Ulmer  “CANet: An Unsupervised Intrusion Detection System for High Dimensional CAN Bus Data”  In _IEEE Access_ 8, 2020, pp. 58194–58205  DOI: 10.1109/ACCESS.2020.2982544
  * [20] Wonsuk Choi et al.  “VoltageIDS: Low-Level Communication Characteristics for Automotive Intrusion Detection System”  In _IEEE Transactions on Information Forensics and Security_ 13.8, 2018, pp. 2114–2129  DOI: 10.1109/TIFS.2018.2812149
  * [21] Adrian Taylor, Sylvain Leblanc and Nathalie Japkowicz  “Anomaly Detection in Automobile Control Network Data with Long Short-Term Memory Networks”  In _2016 IEEE International Conference on Data Science and Advanced Analytics (DSAA)_ , 2016, pp. 130–139  DOI: 10.1109/DSAA.2016.20
  * [22] Min-Joo Kang and Je-Won Kang  “Intrusion Detection System Using Deep Neural Network for In-Vehicle Network Security”  In _PLoS ONE_ 11, 2016
  * [23] Md Delwar Hossain et al.  “An Effective In-Vehicle CAN Bus Intrusion Detection System Using CNN Deep Learning Approach”  In _GLOBECOM 2020 - 2020 IEEE Global Communications Conference_ , 2020, pp. 1–6  DOI: 10.1109/GLOBECOM42002.2020.9322395
  * [24] Alexey Kurakin, Ian J. Goodfellow and Samy Bengio  “Adversarial Machine Learning at Scale”  In _CoRR_ abs/1611.01236, 2016  arXiv: http://arxiv.org/abs/1611.01236
  * [25] Ram Shankar Siva Kumar et al.  “Adversarial Machine Learning-Industry Perspectives”  In _2020 IEEE Security and Privacy Workshops (SPW)_ , 2020, pp. 69–75  DOI: 10.1109/SPW50608.2020.00028
  * [26] Nicolas Papernot et al.  “Practical Black-Box Attacks against Machine Learning”, 2017, pp. 506–519  DOI: 10.1145/3052973.3053009
  * [27] Battista Biggio and Fabio Roli  “Wild patterns: Ten years after the rise of adversarial machine learning”  In _Pattern Recognition_ 84, 2018, pp. 317–331  DOI: https://doi.org/10.1016/j.patcog.2018.07.023
  * [28] Kasun Amarasinghe et al.  “Framework for Data Driven Health Monitoring of Cyber-Physical Systems”  In _2018 Resilience Week (RWS)_ , 2018, pp. 25–30  DOI: 10.1109/RWEEK.2018.8473535
  * [29] Abdelouahid Derhab et al.  “Histogram-Based Intrusion Detection and Filtering Framework for Secure and Safe In-Vehicle Networks”  In _IEEE Transactions on Intelligent Transportation Systems_ , 2021, pp. 1–14  DOI: 10.1109/TITS.2021.3088998
  * [30] Ivo Berger et al.  “Comparative Study of Machine Learning Methods for In-Vehicle Intrusion Detection”  In _CyberICPS/SECPRE@ESORICS_ , 2018