Deep-Learning Intrusion Detection for Connected and Autonomous Vehicles

CAN We Detect It? A Deep Dive into Intrusion Detection for IVNs

Controller Area Network (CAN) protocol, invented by Bosch in the 1980s and still fundamental today, is the backbone to facilitate communication between electronic systems. And modern day self-driving cars rely heavily on CAN for internal communications between their Electronic Control Units (ECUs). However, this protocol lacks intrinsic security measures, making In-Vehicle Networks (IVNs) susceptible to malicious attacks. This study demonstrates an AI-driven Intrusion Detection System (IDS) to identify anomalies in CAN bus traffic using a comparative suite of machine learning and deep learning models. Six models were systematically implemented and evaluated: Isolation Forest, a Dense Autoencoder, a Long Short-Term Memory (LSTM) Autoencoder, a Gated Recurrent Unit (GRU) Autoencoder, a Convolutional Neural Network-Long Short-Term Memory (CNN-LSTM) hybrid, and XGBoost. The CNN-LSTM and XGBoost achieved the highest detection accuracy at 89%, with F1-score of 0.89, demonstrating the feasibility of AI-based IDS solutions for enhancing real-time cybersecurity posture of modern connected vehicles.

Resource-Constrained CAN Intrusion Detection with Distilled Decision Trees

A Progressive Machine Learning Framework for Intrusion Prevention in Controller Area Networks: Multi-Scenario Evaluation for Secure Automotive Systems

Modern vehicles rely heavily on in-vehicle Controller Area Network (CAN) communication to coordinate safety-critical electronic control units (ECUs). However, the CAN protocol was not originally designed with authentication, encryption, or message integrity mechanisms, making it vulnerable to injection, spoofing, fuzzy, and denial-of-service attacks. Although machine learning-based intrusion detection systems have achieved high detection accuracy on CAN traffic, detection alone is not sufficient for safety-critical automotive environments where malicious messages may affect ECUs before a response is triggered. This paper presents a progressive machine learning-based framework for prevention-oriented CAN bus security. The framework analyzes statistical and temporal CAN traffic features and evaluates multiple machine learning models under three scenarios: binary attack detection, attack-type classification, and prevention-oriented allow/block decision evaluation. The study uses the Car-Hacking dataset and compares several supervised and anomaly-detection models, including tree-based ensembles, linear models, probabilistic models, neural models, and anomaly detectors. The results show that tree-based models achieve the strongest overall performance, with Random Forest reaching 99.6% accuracy in binary detection. The proposed prevention layer is evaluated as a software-level decision mechanism that converts model outputs into allow/block decisions, while CAN-aware blocking mechanisms are discussed only as architectural deployment options for future inline gateway implementation. The findings indicate that lightweight tree-based machine learning models can support real-time prevention-oriented decisions in CAN security, while further validation on hardware testbeds, realistic CAN bus-load conditions, and cross-dataset settings remains necessary.

Behavioral Residualization for Unsupervised Intrusion Detection in Automotive CAN Networks

Per-ID behavioral residualization is presented, a CAN-specific representation that extracts fourteen temporal, protocol, and payload features from sliding windows and residualizes them against each arbitration ID's normal baseline, which improves mean F1 in the majority of evaluations.

Intrusion detection systems for the internet of vehicles: a systematic survey of techniques and challenges across CAN bus and vehicular networks

This paper presents a comprehensive and systematic review of deep learning techniques applied to cyber intrusion detection within IoV systems, conducted in accordance with the PRISMA framework across 83 selected studies published between 2020 and 2025.

DEEP LEARNING-BASED INTRUSION DETECTION IN COMPUTER SYSTEMS AND NETWORKS: ADVANCES, HYBRIDS, AND CHALLENGES 2022–2026

The work is devoted to a comprehensive systematic review of advances in identifying the state of computer systems and networks in the context of cybersecurity for the period 2022–2026. The study analyzes the evolution of intrusion detection systems (IDS), provides categorization and synthesis of key approaches, including supervised, unsupervised, and semi-supervised learning, as well as statistical and temporal analysis methods. Particular attention is paid to deep learning models (CNN, RNN/LSTM, Transformers, GNN) and their hybrid combinations, which demonstrate accuracy above 95% in detecting complex multi-stage attacks and zero-day threats. The experience of implementing identification methods in specific domains such as IoT, SCADA, automotive networks, and maritime transportation systems is summarized. Critical challenges for the scientific community are identified, including the problem of explainable artificial intelligence (XAI), resilience to adversarial attacks, and optimization for real-time operation on resource-constrained devices. Conclusions. The study revealed a trend of transition from classical static signature-based methods to dynamic intelligent algorithms. The analysis of available sources made it possible to classify the considered approaches according to their mathematical foundations and operational characteristics. For each group of methods, their main advantages, disadvantages, and key prospects for application were identified. It was found that hybrid and ensemble models provide the highest accuracy in complex environments (over 99%), while the combination of convolutional neural networks with recurrent networks or Transformers is the most effective solution for detecting multi-stage attacks. In addition, the growing role of federated learning in the development and implementation of intrusion detection systems was emphasized.