Jun 2026· Peer-to-Peer Networking and Applications· Vol 19· 0 citations· 41 references
Computer Science
TL;DR
This work proposes a novel Intrusion Detection Systems (IDS) based on eXtreme Gradient Boosting (XGBoost), specifically optimized for analyzing CAN bus data, which achieves outstanding detection performance and maintains low false positive rates and strongly generalizes unseen data.
Abstract
Modern automobiles rely on CAN buses to connect Electronic Control Units (ECUs), but these connections introduce significant security vulnerabilities due to the lack of inherent security mechanisms. Intrusion Detection Systems (IDS) have become essential tools for securing CAN buses, but developing an effective IDS poses major challenges, such as achieving high detection accuracy across various attack types, ensuring real-time performance, and maintaining efficiency in resource-constrained automotive environments. To address these challenges, we propose a novel IDS based on eXtreme Gradient Boosting (XGBoost), specifically optimized for analyzing CAN bus data. Our approach incorporates tailored feature engineering techniques, including message timing analysis, arbitration priority, and payload evaluation, to effectively detect anomalies in CAN messages. The system is evaluated extensively on multiple datasets encompassing attack types such as Denial of Service (DoS), Fuzzy, Gear, and RPM manipulation. Experimental results demonstrate that our IDS achieves outstanding detection performance, with accuracy reaching up to 99% for all attack scenarios. Moreover, the IDS maintains low false positive rates and strongly generalizes unseen data. In terms of real-time performance, the system achieves detection latencies of under 35 ms for analyzing 1000 consecutive attacks and normal frames. The system operates efficiently on embedded hardware with a minimal computational overhead of 3.5% of the processing unit. These results validate the practicality and scalability of the proposed IDS for real-world automotive applications.
In the era of contemporary data traffic routing, the concept of Intrusion Detection Systems (IDS) is substantially utilized. However, the efficacy of IDS is often decreased because of the reality that high-concentration traffic postfixes, sophisticated cyber criminals, and more and more stringent demands are tending to decrease in resource-limited environments. The paper presents the enhanced intrusion detection system based on deep learning architecture, which can be flexible, adaptive and as well maintain the high detection capability with confidence under changing or to-be changed network settings. The objectives of this and aforementioned also address the issue of avoiding strong overtting behavior by models during the transfer learning and even rich feature representation through the first-stage operation: moving to address and ideally preventing attacks rather than supporting other attacks. The work is tailored to the deployment of the light-weight and adaptive IDS design which is supposed to be large enough to work in real time on low-powered devices such as IoTs and edge devices that are nondominated in energy and computationally less demanding. Real-time adaptability of the model will be examined through operational deployment simulations. It is also expected that such simulations would take into account latency, throughput, and energy consumption of the IDS model. On the one hand, In a stage nested within the very last period of this research, the IDS model has been merged with Explainable AI technologies; now LIME and SHAP are also preserved to improve the interpretability of the model decisions and the level of decision-making. What kind of feature attributions are made with the intrusion data? How is Interpretability of the model evaluated in terms of fidelity, comprehensibility, and expert belief? Therefore, all the above-mentioned events will be a perfect example of how the technologically ingrained tasks, particularly in the technical discipline of security studies, can be wrapped into the very cognitive resource of human beings.
Krishna Kumar Tiwari· 2026 International Conferenc...· 0 citations
Critical safety functions in modern vehicles rely heavily on intra-vehicle networks (IVNs), primarily via the Controller Area Network (CAN) protocol. The inherent vulnerabilities of CAN require robust intrusion detection systems (IDS) to mitigate adversarial threats. However, state-of-the-art IDS, especially AI-based approaches, often lack a comprehensive, well-defined performance analysis method. This work proposes and evaluates a structured pipeline for in-vehicle IDS, analyzing an autoencoder semi-supervised IDS as a practical case study. The method is validated on publicly available datasets, covering multiple attack types, with additional analysis of generalization capabilities. Performance is rigorously assessed using precision, recall, F1-score, and the Matthews Correlation Coefficient (MCC), chosen for its robustness in imbalanced scenarios. Results demonstrated highly efficient identification of DoS attacks (MCC 1.00), though Fuzzy DoS detection showed lower performance (MCC 0.214 in CAN-MIRGU and 0.074 in CAN-MODES). These findings support the viability of the proposed pipeline for IDS analysis focusing on enhancing CAN network security, consistent with recent research trends.
Lucas Melo da Silva Alves, Alexandre dos Santos Roque, E. P. de Freitas· International Conference on...· 0 citations
Cyber-physical systems (CPSs) could cause actuation and safety risks. Intrusion detection is essential for preserving the system's integrity due to growing security issues. Nowadays, deep learning (DL) schemes have been deployed to enhance the detection of cyber-attacks, yet these models are prone to overfitting, which reduces detection performance. Hence, this research proposes a novel deep learning-based Intrusion Detection System (IDS) for CPS to address these limitations. The proposed methodology consists of four key stages, including preprocessing, feature extraction, feature selection, and intrusion detection. Data preprocessing is performed via cleansing, followed by the extraction of statistical [mean, median, and standard deviation (SD)], entropy-based, improved correlation, improved mutual information (MI), flow-based, and Improved Information Gain (IIG) features, which are derived to obtain the important features. The Archimedes Algorithm with Team Work Principle (AA_TWP), integrating the Archimedes Optimization Algorithm (AOA) and the Teamwork Optimization Algorithm (TOA), with modifications to the exploration phase, is employed to efficiently select the most relevant features. The selected features, along with preprocessed data, are fed into an ensemble of Deep Belief Networks (DBNs), Quantum Deep Neural Networks (QDNNs), and optimized Bidirectional Long Short-Term Memory (Bi-LSTM), with Bi-LSTM weights further tuned by AA_TWP. The ensemble outputs are averaged to produce the final intrusion decision. Experimental results demonstrate 91.52% accuracy and 91.76% Matthews Correlation coefficient (MCC), highlighting the effectiveness of the proposed approach, which outperforms existing techniques.
Maloth Sagar, V. C.· Frontiers of Computer Scienc...· 0 citations
The Controller Area Network (CAN) bus continues to serve as the core communication backbone of modern vehicles. However, its original design did not incorporate fundamental security mechanisms, leaving in-vehicle networks vulnerable to cyberattacks such as spoofing, replay, message injection, and denial-of-service. As a result, Intrusion Detection Systems (IDSs) have become an essential component of automotive cybersecurity, providing continuous monitoring of CAN traffic to identify malicious behavior. In recent years, researchers have increasingly turned to intelligent IDS solutions based on Machine Learning (ML), Deep Learning (DL), and hybrid learning approaches to enhance detection capability. Although many of these studies report impressive detection accuracy, their evaluation practices often vary significantly, and claims related to real-time performance or lightweight deployment are frequently made without sufficient practical validation. This survey provides a structured, deployment-focused review of learning-based IDSs for CAN bus security published between 2019 and 2025. Building on prior surveys that emphasize detection accuracy and high-level method categorization, this work evaluates IDS approaches from a practical perspective by considering detection performance alongside computational efficiency, real-time feasibility, and deployment readiness in resource-constrained automotive environments. ML-based, DL-based, and hybrid IDS approaches are organized within a unified taxonomy and systematically compared across model architectures, attack scenarios, datasets, real-time feasibility, lightweight design claims, and validation strategies. A key contribution of this survey is the introduction of explicit and consistent criteria for labeling IDSs as lightweight, real-time, or deployable, based only on substantiated evidence such as ECU-oriented runtime analysis, embedded evaluation, or real-vehicle experimentation. Through a set of unified comparative tables, the survey highlights common evaluation gaps, and mismatches between reported performance and practical feasibility.
Athar Ghadi, Tauheed Khan Mohd· Journal of the Brazilian Com...· 0 citations
A DT-based IDS that jointly models physical relationships among decoded powertrain signals and identifies attacks through residuals between predicted and observed behavior shows promise for detecting stealthy payload-level CAN attacks that preserve normal communication patterns, supporting behavior-based cybersecurity for connected and automated vehicles.
Araf Rahman, M. Salek, Mashrur Chowdhury· 0 citations
Per-ID behavioral residualization is presented, a CAN-specific representation that extracts fourteen temporal, protocol, and payload features from sliding windows and residualizes them against each arbitration ID's normal baseline, which improves mean F1 in the majority of evaluations.