CAN We Detect It? A Deep Dive into Intrusion Detection for IVNs

Abstract

Controller Area Network (CAN) protocol, invented by Bosch in the 1980s and still fundamental today, is the backbone to facilitate communication between electronic systems. And modern day self-driving cars rely heavily on CAN for internal communications between their Electronic Control Units (ECUs). However, this protocol lacks intrinsic security measures, making In-Vehicle Networks (IVNs) susceptible to malicious attacks. This study demonstrates an AI-driven Intrusion Detection System (IDS) to identify anomalies in CAN bus traffic using a comparative suite of machine learning and deep learning models. Six models were systematically implemented and evaluated: Isolation Forest, a Dense Autoencoder, a Long Short-Term Memory (LSTM) Autoencoder, a Gated Recurrent Unit (GRU) Autoencoder, a Convolutional Neural Network-Long Short-Term Memory (CNN-LSTM) hybrid, and XGBoost. The CNN-LSTM and XGBoost achieved the highest detection accuracy at 89%, with F1-score of 0.89, demonstrating the feasibility of AI-based IDS solutions for enhancing real-time cybersecurity posture of modern connected vehicles.