Deep-Learning Intrusion Detection for Connected and Autonomous Vehicles

Abstract

Connected and autonomous vehicles increasingly rely on the Controller Area Network (CAN) bus to interconnect dozens of electronic control units (ECUs). The CAN protocol is reliable and real-time, yet it was designed without authentication, encryption, or sender verification. In-vehicle networks are therefore exposed to message injection threats such as denial-of-service (DoS), fuzzing, spoofing, and replay attacks. This paper presents a hybrid deep-learning intrusion detection system (IDS) that combines one-dimensional convolutional layers, a bidirectional long short-term memory (BiLSTM) network, and a temporal attention mechanism to detect malicious activity directly from CAN frame streams. The model ingests sliding windows of CAN identifiers, payload bytes, and inter-arrival timing features. It can therefore learn both the spatial structure of individual frames and the temporal regularity of legitimate bus traffic. The approach is evaluated on the public CAR-Hacking dataset, which contains labelled DoS, fuzzy, and spoofing attacks captured from a real vehicle, augmented here with a replay scenario. On the held-out test set the proposed IDS attains 99.93% overall accuracy, a macro-averaged F1-score of 0.993, and a mean per-window detection latency of about 0.71 ms. It outperforms support-vector-machine, deep-neural-network, and pure convolutional baselines, particularly on the harder fuzzy and replay classes. Deployment considerations for resource-constrained ECUs and automotive edge gateways are discussed, including model quantization, throughput headroom, and alignment with the ISO/SAE 21434 cybersecurity engineering standard. The results are illustrative of the design rather than a deployed field study.