Jul 2026· Annual International Computer Software and Applications Conference· pp. 3274-3275· 0 citations· 4 references
Computer Science
Abstract
Controller Area Network (CAN) protocol, invented by Bosch in the 1980s and still fundamental today, is the backbone to facilitate communication between electronic systems. And modern day self-driving cars rely heavily on CAN for internal communications between their Electronic Control Units (ECUs). However, this protocol lacks intrinsic security measures, making In-Vehicle Networks (IVNs) susceptible to malicious attacks. This study demonstrates an AI-driven Intrusion Detection System (IDS) to identify anomalies in CAN bus traffic using a comparative suite of machine learning and deep learning models. Six models were systematically implemented and evaluated: Isolation Forest, a Dense Autoencoder, a Long Short-Term Memory (LSTM) Autoencoder, a Gated Recurrent Unit (GRU) Autoencoder, a Convolutional Neural Network-Long Short-Term Memory (CNN-LSTM) hybrid, and XGBoost. The CNN-LSTM and XGBoost achieved the highest detection accuracy at 89%, with F1-score of 0.89, demonstrating the feasibility of AI-based IDS solutions for enhancing real-time cybersecurity posture of modern connected vehicles.
A hybrid deep-learning intrusion detection system (IDS) that combines one-dimensional convolutional layers, a bidirectional long short-term memory (BiLSTM) network, and a temporal attention mechanism to detect malicious activity directly from CAN frame streams is presented.
Ginne M James· International Journal of Inf...· 0 citations
LSTM had good detection for frequent attacks and slow-changing patterns, which shows its capacity in learning long-lasting dependencies, which shows its capacity in learning long-lasting dependencies.
Jawad Hussain Awan, Misbah Safdar, Muhammad Ayaz Shirazi et al.· Italian National Conference...· 0 citations
Controller Area Network (CAN) is the dominant in-vehicle bus, yet its broadcast design and absent authentication leave it exposed to injection and spoofing attacks. Existing deep-learning intrusion detection systems achieve strong accuracy but depend on ML inference frameworks incompatible with the resource budgets of production Electronic Control Units (ECUs). We present a systems-oriented pipeline that trains four neural architectures—Transformer, CNN, LSTM, and ANN—on a five-class labeled CAN dataset and distills each into a framework-free C++ decision tree via the Trustee protocol. We observe and address a systematic false-alarm collapse on Normal-class traffic: standard Trustee produces around 30% FPR-N because Normal frames constitute only 5.4% of training data. A class-balanced Trustee variant, which oversamples Normal by factor α=5, reduces FPR-N to 13.8±1.4% (three Trustee runs) while preserving 91.1±0.6% accuracy and 0.918±0.006 macro-F1 at 2.1% CPU on a Raspberry Pi 4, versus 22.6% for TF-Lite int8 and 59.4% for TensorFlow on the same board. We additionally report α and depth ablations, three-seed teacher statistics, and per-class recall for all models.Code: https://github.com/Amirmasoud-Pourmiri/Lightweight-Neural-Network-Distillation-for-Real-Time-CAN-Bus-Intrusion-Detection-in-Vehicles
Amirmasoud Pourmiri, Ali Eslami, Sergio A. Salinas Monroy· International Conference on...· 0 citations
A taxonomy of IDS architectures and a survey of recently proposed networks, such as Convolutional Neural Networks (CNNs), Recurrent Neural Networks (RNNs), LSTMs, GRUs, Autoencoders, GANs, Transformer-based, as well as hybrids are developed.
Sajith K. V., Gripsy Paul, Bhagavant Deshpande et al.· Journal of Network and Infor...· 0 citations
The rapid growth of digital communication technologies, cloud computing, and Internet of Things (IoT) devices has
increased both the frequency and sophistication of cyber-attacks, making effective intrusion detection an essential component of
modern cybersecurity systems. Traditional signature-based intrusion detection systems (IDS) are effective against known attacks
but fail to detect previously unseen or evolving threats. This study investigates the application of deep learning models for binary
network intrusion detection using the NSL-KDD benchmark dataset. Three standalone architectures, Convolutional Neural
Networks (CNN), Long Short-Term Memory (LSTM) networks, and Deep Neural Networks (DNN), are implemented and
evaluated, alongside a CNN-LSTM Hybrid model that integrates spatial and sequential learning, and a DNN-LSTM Ensemble
model that combines independently trained DNN and LSTM predictions through weighted averaging. Following data cleaning,
categorical encoding, normalization, and Random Forest-based feature selection (41 features reduced to 20), all models were
trained and evaluated under identical conditions using Accuracy, Precision, Recall, F1-Score, ROC-AUC, training time, and
inference time. The standalone DNN model achieved the best overall performance, with 80.98% accuracy, 97.08% precision,
68.66% recall, 80.43% F1-score, and 96.11% ROC-AUC, while also requiring the shortest training time (39.69 s). The CNNLSTM Hybrid model attained the highest precision (97.23%) but did not outperform the standalone architectures overall, and
the DNN-LSTM Ensemble produced balanced but not superior results. These findings indicate that carefully designed
standalone architectures can match or exceed the performance of more complex hybrid and ensemble models for binary
intrusion detection, while incurring substantially lower computational cost. The study contributes a controlled, commonframework comparison of five deep learning architectures and provides practical guidance for selecting computationally
efficient models for anomaly-based intrusion detection.
Ketki Naik, Sanjeev Ghosh· International Journal for Re...· 0 citations
The Controller Area Network (CAN) bus serves as the primary communication framework in modern vehicles, enabling reliable data exchange among Electronic Control Units (ECUs) for seamless interaction. The CAN protocol lacks built-in protection, leaving in-vehicle networks vulnerable to cyberattacks such as denial-of-service, message injection, replay, and suppression.To address these challenges, this study presents a deep learning–based intrusion detection approach that integrates a 1D Convolutional Neural Network (1D CNN) with a Bidirectional Long Short-Term Memory (BiLSTM) model, along with focal loss to improve detection performance. The 1D CNN is responsible for capturing spatial patterns from CAN frame attributes, including arbitration ID, data length code, and payload information. In contrast, the BiLSTM learns temporal dependencies by analyzing sequence patterns in both forward and backward directions. Furthermore, instead of relying on synthetic data balancing techniques such as SMOTE, focal loss is applied to give greater importance to difficult-to-detect attack samples during training, thereby effectively addressing the issue of class imbalance in CAN datasets. Additionally window labeling tactic that helps detect attacks more sensitively within a temporal window is also proposed. Besides these, the Car-Hacking dataset (driving scenario) with stratified 10-fold cross-validation is used to test the above framework. The experimental results demonstrate that the proposed approach can achieve an accuracy of 97.41%, precision of 96.37%, recall of 96.73%, F1-score of 96.49%, and ROC-AUC of 0.9971 which is way above the baseline BiLSTM model performance from the previous work. These findings confirm that a combination of spatial feature extraction, temporal sequence modeling, and imbalance-aware optimization not only ensures but also delivers a highly effective and more reliable intrusion detection solution for in-vehicle CAN network security.
A. Malini, Gerardine Immaculate Mary· PLoS ONE· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
