Digital Twin-Based Intrusion Detection for Vehicle Powertrain CAN Bus Systems

Behavioral Residualization for Unsupervised Intrusion Detection in Automotive CAN Networks

Modern vehicles rely on the Controller Area Network (CAN) bus, whose design prioritizes low cost and real-time performance but provides no message authentication or encryption. An attacker with physical or remote access can therefore inject arbitrary frames, making intrusion detection an important defense-in-depth mechanism. Most published CAN intrusion detection systems rely on presence-based features, such as novel arbitration IDs, frozen payload bytes, or anomalous DLC values. These features perform well on public datasets containing easily separable attacks but fail when attackers reuse legitimate arbitration IDs. We present per-ID behavioral residualization, a CAN-specific representation that extracts fourteen temporal, protocol, and payload features from sliding windows and residualizes them against each arbitration ID's normal baseline. Our central claim is that this representation, rather than any individual detector, drives the performance gains. Across six unsupervised detectors and two datasets, residualization improves mean F1 in the majority of evaluations (21/24 on HCRL and 30/36 on ROAD across five seeds). On the more realistic ROAD dataset, where attacks reuse legitimate IDs, the representation achieves recall>= 0.99 with high ROC-AUC on targeted signal-manipulation attacks. Two limitations are explicitly quantified: novel-ID flooding (HCRL DoS, F1 = 0.02) and cross-ID fuzzing (ROAD, F1 = 0.27), defining the measured coverage boundary of the proposed representation.

Secure intrusion detection system for industrial control systems using digital twins

IDS_XGB: Next-Generation Intrusion Detection for Automotive Embedded Systems

Modern automobiles rely on CAN buses to connect Electronic Control Units (ECUs), but these connections introduce significant security vulnerabilities due to the lack of inherent security mechanisms. Intrusion Detection Systems (IDS) have become essential tools for securing CAN buses, but developing an effective IDS poses major challenges, such as achieving high detection accuracy across various attack types, ensuring real-time performance, and maintaining efficiency in resource-constrained automotive environments. To address these challenges, we propose a novel IDS based on eXtreme Gradient Boosting (XGBoost), specifically optimized for analyzing CAN bus data. Our approach incorporates tailored feature engineering techniques, including message timing analysis, arbitration priority, and payload evaluation, to effectively detect anomalies in CAN messages. The system is evaluated extensively on multiple datasets encompassing attack types such as Denial of Service (DoS), Fuzzy, Gear, and RPM manipulation. Experimental results demonstrate that our IDS achieves outstanding detection performance, with accuracy reaching up to 99% for all attack scenarios. Moreover, the IDS maintains low false positive rates and strongly generalizes unseen data. In terms of real-time performance, the system achieves detection latencies of under 35 ms for analyzing 1000 consecutive attacks and normal frames. The system operates efficiently on embedded hardware with a minimal computational overhead of 3.5% of the processing unit. These results validate the practicality and scalability of the proposed IDS for real-world automotive applications.

Defending Against State-Inducing Spoofing Attacks in Intelligent Connected Vehicles: A Real-Time Temporal Feature Fusion Framework

As intelligent connected vehicles (ICVs) integrate advanced driver-assistance systems (ADAS) and autonomous-driving functions, CAN bus attacks have become more diverse in mechanism and safety impact. Beyond flooding or direct command injection, state-inducing spoofing attacks inject falsified CAN frames to manipulate vehicle-state signals. Rather than directly controlling vehicle behavior, they mislead ADAS state estimation, potentially triggering inappropriate control responses and threatening driving safety. Existing intrusion detection methods mainly target conventional CAN attacks and limited operating states, leaving limited detection generalization in complex attack scenarios. Accordingly, this paper proposes MTFF, a multi-scale temporal feature fusion framework for CAN intrusion detection. MTFF builds two complementary CAN streams: an intra-ID kinematic sequence capturing short-term state continuity under the same identifier and an inter-ID scheduling sequence capturing timing relationships among neighboring frames, thereby characterizing CAN traffic from state-continuity and scheduling-relation perspectives. Multi-scale 1-D convolutions extract local temporal features, while positional self-attention and symmetric cross-attention model long-range dependencies and fuse the streams to detect contextual temporal and state inconsistencies. Experiments on multi-vehicle CAN datasets covering representative operating states show that, in the most challenging setting, MTFF achieves F1-scores above 0.94 on two production vehicles, with per-frame latency below 0.006 ms.

Transformer-based Network Anomaly Detection System for Intelligent Cyber Security Monitoring

As MNI becomes increasingly vulnerable to new kinds of attacks from the cyber world, accurate and timely detection of intrusions becomes a primary key to the power of cybersecurity. More complex attack patterns, complex traffic interactions within large scales are not very collaborable with the typical signature-based detection methods. A Transformer Based Network Anomaly Detection System for intelligent cyber security monitoring based on network flow analysis (NFAs) is proposed in the paper. This framework is derived from the CICIDS2017 data-set and proposes 78 of the statistical flow characteristics, where each flow characteristic impacts the behaviour of a packet, protocol, volume of traffic and temporal communication pattern. The model uses a Transformer Encoder network architecture along with multiple heads of self-attention, which provides greater understanding to deal with complex relationships between features from network traffic. LabelEncoder and StandardScaler have been applied to the columns with values that need to be encoded for categorical variables and scaled to fit the values for models training. A trained model is then applied to progress multiple different categories of cyberattacks including DDoS attacks, PortScan, Brute Force, Botnet, Web Based, etc. and different kinds of traffic, all traffic is considered benign traffic. For providing real-time predictions, confidence interval, prediction of class severity and alerts using trained model an API developed on flask to connect the trained model to a dashboard was built. The experimental results show that the Transformer-based learning could be very effective in achieving successful capturing of the network behavior and conducting realistic detection. The overall proposed system offers an intelligent, scalable and deployment-centric approach to improve the monitoring and proactive detection of threats in contemporary networks in the field of cybersecurity.

ASDS: Adaptive Stackelberg Defense Scheme for Cyber-Physical Intrusion Detection in Cloudified Transportation Systems

Cloud-enabled Intelligent Transportation Systems (ITS) leverage Vehicle-to-Everything (V2X) communications to support scalable data processing and real-time traffic management. However, this integration significantly expands the cyber-physical attack surface. Conventional intrusion detection systems (IDSs) that rely on static signatures or offline-trained models are often ill-suited to counter adaptive attackers. This paper presents the Adaptive Stackelberg Defense Scheme (ASDS), a proactive intrusion detection system that models attacker-defender interactions as a hierarchical Bayesian Stackelberg game with incomplete information. ASDS employs Bayesian filtering to jointly estimate system states and attacker types in real time, enabling adaptive defense strategies. Evaluated against False Data Injection (FDI), Denial-of-Service (DoS), and spoofing attacks, ASDS achieves detection accuracy between 94% and 98%, false positive rates ranging from 0.02 to 0.08, and response latency under 50 ms. These results underscore its effectiveness in securing cloud-enabled ITS environments.