Per-ID behavioral residualization is presented, a CAN-specific representation that extracts fourteen temporal, protocol, and payload features from sliding windows and residualizes them against each arbitration ID's normal baseline, which improves mean F1 in the majority of evaluations.
Abstract
Modern vehicles rely on the Controller Area Network (CAN) bus, whose design prioritizes low cost and real-time performance but provides no message authentication or encryption. An attacker with physical or remote access can therefore inject arbitrary frames, making intrusion detection an important defense-in-depth mechanism. Most published CAN intrusion detection systems rely on presence-based features, such as novel arbitration IDs, frozen payload bytes, or anomalous DLC values. These features perform well on public datasets containing easily separable attacks but fail when attackers reuse legitimate arbitration IDs. We present per-ID behavioral residualization, a CAN-specific representation that extracts fourteen temporal, protocol, and payload features from sliding windows and residualizes them against each arbitration ID's normal baseline. Our central claim is that this representation, rather than any individual detector, drives the performance gains. Across six unsupervised detectors and two datasets, residualization improves mean F1 in the majority of evaluations (21/24 on HCRL and 30/36 on ROAD across five seeds). On the more realistic ROAD dataset, where attacks reuse legitimate IDs, the representation achieves recall>= 0.99 with high ROC-AUC on targeted signal-manipulation attacks. Two limitations are explicitly quantified: novel-ID flooding (HCRL DoS, F1 = 0.02) and cross-ID fuzzing (ROAD, F1 = 0.27), defining the measured coverage boundary of the proposed representation.
A DT-based IDS that jointly models physical relationships among decoded powertrain signals and identifies attacks through residuals between predicted and observed behavior shows promise for detecting stealthy payload-level CAN attacks that preserve normal communication patterns, supporting behavior-based cybersecurity for connected and automated vehicles.
Araf Rahman, M. Salek, Mashrur Chowdhury· 0 citations
Intrusion detection in resource-constrained IoT networks typically relies on dedicated sniffer nodes, an architecture that does not transfer to heterogeneous deployments where adding monitoring hardware is operationally impractical. This paper presents a sniffer-free detection pipeline that operates exclusively on the integer counters each mote already maintains for normal operation of RPL (IPv6 Routing Protocol for Low-Power and Lossy Networks). Behavioral features are derived from these counters through configurable layers spanning statistical transforms, time-series characteristics, and dynamical complexity measures. The central mechanism is an observability-driven loop in which feature attribution is used not only to explain the trained model but to diagnose which behavioral signals the counter set fails to expose. The identified gaps motivate a firmware extension that exposes them. The pipeline is evaluated across $1{\,}200$ simulation runs spanning eight topology scales (25 to 400 nodes) under cross-topology evaluation, and on two public datasets. A diagnostic stage with standard counters reveals detection ceilings traced to specific control-plane signals absent from the default firmware. Retraining with the extended counter set raises every attack above 89% F1, with a unified detector reaching 94.2%, which confirms that the ceiling was an observability limit rather than a limit of classifier capacity. The machine-learning components are established tools, and the contribution is their coupling into this diagnostic loop together with the on-mote architecture that makes it deployable. The results indicate that detection in constrained IoT networks is bounded by what the mote reports, not by classifier sophistication.
E. Pacheco, C. Pedroso· IEEE Open Journal of the Com...· 0 citations
The transition toward Software-Defined Vehicles has rendered internal networks, particularly the Controller Area Network, vulnerable to sophisticated cyberattacks. Although recent research has prioritized Deep Learning Intrusion Detection Systems for their statistical accuracy, these black-box models often fail to meet the strict latency and explainability constraints of automotive safety standards. This article proposes a Multi-Standard (CAN/CAN-FD) logic extraction framework validated herein on legacy CAN and CAN Flexible Data-rate, that reconciles high-precision detection with the deterministic requirements of embedded systems. By employing an elastic parsing mechanism and a constrained Classification and Regression Tree algorithm, the methodology distills complex attack signatures into compact, interpretable boolean rules. Unlike computationally intensive neural networks, this white-box approach ensures deterministic, bounded, worst-case execution time by design. Experimental validation using diverse datasets, including legacy and high-bandwidth CAN Flexible Data-rate traffic, demonstrates that the extracted boolean logic achieves a deterministic algorithmic inference latency as low as 0.15 microseconds. When benchmarked in an identical hardware environment, this represents a 14× empirical speedup over optimized internal ML baselines (XGBoost), and theoretically eliminates the heavy matrix multiplication overhead typical of state-of-the-art deep learning approaches, while maintaining average detection accuracy above 99.97 percent for the CAN Flexible Data-rate. Furthermore, the generated logic satisfies the interpretability mandates of functional safety standards.
Rithvika G, R. R.· Scientific Reports· 0 citations
Connected and autonomous vehicles increasingly rely on the Controller Area Network (CAN) bus to interconnect dozens of electronic control units (ECUs). The CAN protocol is reliable and real-time, yet it was designed without authentication, encryption, or sender verification. In-vehicle networks are therefore exposed to message injection threats such as denial-of-service (DoS), fuzzing, spoofing, and replay attacks. This paper presents a hybrid deep-learning intrusion detection system (IDS) that combines one-dimensional convolutional layers, a bidirectional long short-term memory (BiLSTM) network, and a temporal attention mechanism to detect malicious activity directly from CAN frame streams. The model ingests sliding windows of CAN identifiers, payload bytes, and inter-arrival timing features. It can therefore learn both the spatial structure of individual frames and the temporal regularity of legitimate bus traffic. The approach is evaluated on the public CAR-Hacking dataset, which contains labelled DoS, fuzzy, and spoofing attacks captured from a real vehicle, augmented here with a replay scenario. On the held-out test set the proposed IDS attains 99.93% overall accuracy, a macro-averaged F1-score of 0.993, and a mean per-window detection latency of about 0.71 ms. It outperforms support-vector-machine, deep-neural-network, and pure convolutional baselines, particularly on the harder fuzzy and replay classes. Deployment considerations for resource-constrained ECUs and automotive edge gateways are discussed, including model quantization, throughput headroom, and alignment with the ISO/SAE 21434 cybersecurity engineering standard. The results are illustrative of the design rather than a deployed field study.
Ginne M James· International Journal of Inf...· 0 citations
: This paper addresses real-time intrusion detection in IEEE 802.11 wireless networks, where unprotected management frames and exploits such as KRACK and Kr00k pose persistent threats. Existing approaches often rely on signature-based detection, device-specific features, or synthetic oversampling, limiting their effectiveness in dynamic, resource-constrained environments. We propose a lightweight, edge-deployed Wireless Intrusion Detection System (WIDS) trained on the AWID3 dataset across eight legacy and modern attack classes. The approach combines a three-stage feature selection pipeline with cost-sensitive learning for compact 27-feature classification at low latency, and a multi-stage validation mechanism (Z-score filtering and temporal persistence) that reduces false positives in real-time. Deployed on a Raspberry Pi and evaluated with a stratified 70/30 split across five algorithms, a tuned Decision Tree achieves 99.76% accuracy and a 0.9797 macro F1-score, with 0.16s batch inference from a model serializing under 30KB, showing that lightweight models can deliver accurate, efficient real-time wireless intrusion detection.
Himasha Jayasekera, Rajani Piyarathna, Chalana Ranwala et al.· Proceedings of the 23rd Inte...· 0 citations
Controller area network (CAN) attacks are often detected using time-based or payload-based features depending on the attack type. We focus on time-based detection of timing transparent attacks, visible in the time domain. The conventional definition of inter-message arrival times is highly affected by the presence of attacks, which undermines the detection performance. Reference times computed from attack messages rather than exclusively normal ones cause this degradation. To overcome this drawback, we propose TISIC, a novel definition of intermessage arrival time that improves the performance of cyberattack detection on the controller area network bus. Our method preserves normal reference times even under attack. We show this improvement using publicly available datasets (Car-Hacking Dataset and X-CANIDS dataset) with respect to various detection performance metrics such as AUROC, AUPR, and $F_{1}$-score.
Rémi Bouchayer, Jae-Yun Jun, H. Chaouchi et al.· International Conference on...· 0 citations