TY - CHAP A1 - Folger, Fabian A1 - Hachani, Murad A1 - Fuxen, Philipp A1 - Graf, Julian A1 - Fischer, Sebastian A1 - Hackenberg, Rudolf T1 - A Transformer-Based Framework for Anomaly Detection in Multivariate Time Series T2 - CLOUD COMPUTING 2025, The Sixteenth International Conference on Cloud Computing, GRIDs, and Virtualization, April 06, 2025 to April 10, 2025, Valencia, Spain N2 - This paper introduces a comprehensive Transformer-based architecture for anomaly detection in multivariate time series. Using self-attention, the framework efficiently processes high-dimensional sensor data without extensive feature engineering, enabling early detection of unusual patterns to prevent critical system failures. In a subsequent laboratory setup, the framework will be applied using fuzzing techniques to induce anomalies in an Electronic Control Unit, while monitoring side channels, such as temperature, voltage, and Controller Area Network messages. The overall structure of the architecture, as well as the necessary preprocessing steps, such as temporal aggregation and classification up to the optimization of the hyperparameters of the model, are presented. The evaluation of the model architecture with the postulated restrictions shows that the model handles anomaly scenarios in the dataset robustly. It is necessary to evaluate the extent to which the model can be used in practical applications in areas, such as cloud environments or the industrial Internet of Things. Overall, the results highlight the potential of Transformer models for the automated and reliable monitoring of complex time series data for deviations. KW - Artificial Intelligence KW - Transformer KW - Time Series KW - Anomaly Detection KW - Temporal Aggregation KW - ECU Y1 - 2025 UR - https://www.thinkmind.org/library/CLOUD_COMPUTING/CLOUD_COMPUTING_2025/cloud_computing_2025_1_80_20078.html SN - 978-1-68558-258-6 SN - 2308-4294 SP - 52 EP - 57 PB - IARIA ER - TY - CHAP A1 - Hachani, Murad A1 - Stey, Miguel A1 - Fuxen, Philipp A1 - Graf, Julian A1 - Hackenberg, Rudolf T1 - GFDG: a genetic fuzzing method for the Controller Area Network Protocol T2 - Cloud Computing 2025 : The Sixteenth International Conference on Cloud Coud Computing, GRIDs, and Virtualization, 06.-10. April 2025, Valencia N2 - Ensuring the security of modern automotive systems is critical due to their increasing complexity and reliance on interconnected Electronic Control Units. The Controller Area Network still serves as a key communication protocol within these systems, making it a primary target for security testing. Traditional fuzz testing approaches for Controller Area Networks often rely on random or brute-force message generation, not leveraging the system’s feedback to improve the generation process. This paper introduces the Genetic Fuzz Data Generator, a fuzzing method that leverages Genetic Algorithms and side-channel analysis to enhance Controller Area Network security testing. The Genetic Fuzz Data Generator dynamically refines its fuzzing strategy by evaluating system responses through side-channel data, such as processing unit temperatures and power supply variations. By structuring Controller Area Network messages as genetic individuals and applying evolutionary principles—including selection, crossover, and mutation—the Genetic Fuzz Data Generator systematically identifies active Controller Area Network IDs and generates targeted fuzz messages. Experimental validation was conducted on a real automotive electronic control unit within a controlled laboratory setup. The first results demonstrated the approach’s effectiveness, revealing system anomalies, including a Denial of Service vulnerability that disrupted functions of the investigated Electronic Control Unit. The findings highlight the potential of feedback-driven fuzzing for improving the efficiency of black-box security testing in Controller Area Network-based systems. Future research could further optimize fitness functions or explore additional side-channel metrics. Y1 - 2025 UR - https://www.thinkmind.org/library/CLOUD_COMPUTING/CLOUD_COMPUTING_2025/cloud_computing_2025_1_60_28009.html SN - 978-1-68558-258-6 SN - 2308-4294 SP - 40 EP - 45 ER - TY - CHAP A1 - Graf, Julian A1 - Hachani, Murad A1 - Fischer, Sebastian A1 - Hackenberg, Rudolf T1 - A heuristic packet processing model for improved encrypted network analysis T2 - CSCS '25: Proceedings of the 2nd Cyber Security in CarS Workshop N2 - Modern networked systems, such as those in the automotive sector, face increasing complexity and growing attack surfaces due to the rise of interconnected and data-driven technologies. Detecting malicious behavior in these environments requires efficient and scalable methods that can operate reliably despite limited resources and high communication volumes. This paper proposes a heuristic packet processing model designed to support intrusion detection based on structural and temporal characteristics of encrypted network traffic. The model follows a modular architecture consisting of four key phases: recording, sorting, prioritizing, and analyzing. At the core of the approach is the Polymetric Queueing Topology Space, a feature space that combines statistical and time series attributes derived from model structure and flow data. These features serve as input for machine learning models, which can effectively distinguish between benign and intrusion traffic patterns without relying on packet data beyond the transport layer. The approach was evaluated using the publicly available ToN_IoT dataset and demonstrated that reliable classification is achievable using a subset of the developed feature space that contains model-derived traffic features. We used Random Forest for supervised binary and multi-class classification achieving high accuracy scores of 99% for binary and 98% for multi-class classification. Additionally, for unsupervised anomaly detection, we created an Isolation Forest model accomplishing F1-scores of 0.92 for the benign and 0.96 for intrusion class. The architecture is designed to enable dynamic traffic prioritization and to offer a flexible foundation that can observe diverse network domains while maintaining efficient performance under constrained computational conditions. Y1 - 2025 U6 - https://doi.org/10.1145/3736130.3764510 PB - ACM CY - New York, USA ER -