Jul 2026· International Conference on Computer Communications and Networks· pp. 1-6· 0 citations· 20 references
Abstract
Controller Area Network (CAN) is the dominant in-vehicle bus, yet its broadcast design and absent authentication leave it exposed to injection and spoofing attacks. Existing deep-learning intrusion detection systems achieve strong accuracy but depend on ML inference frameworks incompatible with the resource budgets of production Electronic Control Units (ECUs). We present a systems-oriented pipeline that trains four neural architectures—Transformer, CNN, LSTM, and ANN—on a five-class labeled CAN dataset and distills each into a framework-free C++ decision tree via the Trustee protocol. We observe and address a systematic false-alarm collapse on Normal-class traffic: standard Trustee produces around 30% FPR-N because Normal frames constitute only 5.4% of training data. A class-balanced Trustee variant, which oversamples Normal by factor α=5, reduces FPR-N to 13.8±1.4% (three Trustee runs) while preserving 91.1±0.6% accuracy and 0.918±0.006 macro-F1 at 2.1% CPU on a Raspberry Pi 4, versus 22.6% for TF-Lite int8 and 59.4% for TensorFlow on the same board. We additionally report α and depth ablations, three-seed teacher statistics, and per-class recall for all models.Code: https://github.com/Amirmasoud-Pourmiri/Lightweight-Neural-Network-Distillation-for-Real-Time-CAN-Bus-Intrusion-Detection-in-Vehicles
Modern vehicles depend on dozens of Electronic Control Units (ECUs) that exchange messages over the Controller Area Network (CAN) bus. Because CAN lacks authentication and encryption, it remains susceptible to message-injection attacks. We present an empirical study of reconstruction-based CAN intrusion detection across four autoencoder families—ANN, CNN, LSTM, and Transformer—trained exclusively on attack-free traffic, together with a post-hoc surrogate-tree interface designed for analyst triage under low-prevalence operation. An AnomalyWrapper adapted from the Trustee framework [1] converts each autoencoder’s reconstruction errors into binary labels; a high-fidelity surrogate decision tree is then fitted to approximate those labels, and individual root-to-leaf decision paths are exposed as per-alert explanations. The LSTM autoencoder achieves an ROC-AUC of 0.996 and a false-positive rate of 0.9 % at a Normal-only threshold (μ+3σ). Because precision-recall measures depend on class prevalence, we evaluate under resampled anomaly rates of 1 %, 0.1 %, and 0.01 %, showing that recall remains stable while precision degrades—a well-known base-rate phenomenon that underscores the need for interpretable triage. Code and models: [GitHub repository].
Amirmasoud Pourmiri, Ali Eslami, Sergio A. Salinas Monroy· International Conference on...· 0 citations
A hybrid deep-learning intrusion detection system (IDS) that combines one-dimensional convolutional layers, a bidirectional long short-term memory (BiLSTM) network, and a temporal attention mechanism to detect malicious activity directly from CAN frame streams is presented.
Ginne M James· International Journal of Inf...· 0 citations
This paper evaluates an ultra-compact five-feature polling scheme (F1–F5) designed to preserve statistical symmetry between control-plane monitoring and telemetry overhead within a dynamic Mininet–Ryu testbed and reveals that tree-based ensembles consistently outperform deep learning approaches.
Intrusion detection systems for 5G networks are typically reported at a single operating point, obscuring the trade-off between missed attacks and false alarms that governs real deployments. Building on a lightweight conditional counter-inspection pipeline, in which a global classifier is selectively validated by curriculum-biased experts under a unanimous dissent rule, we remove the constraint that all components share one learning algorithm, assigning decision trees, random forests, extremely randomized trees, and histogram-based gradient boosting independently to the global (G), malicious-biased (EM), and benign-biased (EB) roles. Across two datasets of contrasting difficulty, 5G-NIDD and UNSW-NB15, all 14 evaluated tree-based configurations reduce missed attacks, by 36.5–79.6% on 5G-NIDD, confirming that the recovery effect is a property of the architecture rather than of decision trees. The expert assignment also selects which error the system controls: the same pipeline can be steered toward fewer false alarms, fewer missed attacks, or higher aggregate F1 without retraining the first stage. The mechanism also rescues a weak linear filter: on 5G-NIDD it cuts false positives and false negatives by 92.8% and 95.8%, and on UNSW-NB15 it raises F1 from 0.903 to 0.934 while reducing missed attacks by 35.5%. These results reframe the pipeline as a configurable validation layer matched to a deployment’s cost structure. We further show, through direct measurement on both datasets, that the conditional routing evaluates at most four of seven models per record, keeping classifier inference below 0.1 ms per record and leaving the detection stage a small contributor to overall processing cost.
Khaoula Tahori, I. Fatani, M. Moughit et al.· Future Internet· 0 citations
Network infrastructure faces mounting pressure from increasingly sophisticated cyber attacks targeting systems reliant on digital connectivity. Activities such as Denial of Service, Probe, Remote-to-Local, and User-to-Root represent persistent threats that are challenging to intercept manually owing to high traffic volumes and rapidly evolving intrusion strategies. This work constructs a web-based Intrusion Detection System prototype by training an entropy-based Decision Tree classifier, conceptually grounded in the C4.5 framework, on the NSL-KDD benchmark. Development adheres to the six-phase CRISP-DM process encompassing business understanding, data preparation, model construction, performance evaluation, and system deployment. Preprocessing involves duplicate record elimination, categorical attribute encoding, and consolidation of multi-class attack labels into a binary Normal/Anomaly scheme. Ten-fold cross-validation yields 99.34% accuracy and 99.35% precision for the Decision Tree, representing a substantial margin over Naive Bayes which attains only 66.67% accuracy. A separate Gain Ratio analysis designates src_bytes as the most informative feature with a value of 0.5366, positioning it as the decision tree root node. The prototype is served through a Streamlit web application that accepts CSV dataset uploads, executes batch anomaly classification, presents detection outcomes through interactive visualizations, and produces exportable reports in both CSV and PDF formats. The system offers an interpretable and practically accessible batch-detection tool, continuous real-time monitoring and evaluation on contemporary intrusion benchmarks are identified as priorities for subsequent research.
Daniel Erick Witopo, Hartana Wijaya· bit-Tech· 0 citations
Per-ID behavioral residualization is presented, a CAN-specific representation that extracts fourteen temporal, protocol, and payload features from sliding windows and residualizes them against each arbitration ID's normal baseline, which improves mean F1 in the majority of evaluations.
Chandan Hegde, M. R. Reddy· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
