Hybrid 1D CNN-BiLSTM with focal loss for robust intrusion detection in in-vehicle CAN networks

Abstract

The Controller Area Network (CAN) bus serves as the primary communication framework in modern vehicles, enabling reliable data exchange among Electronic Control Units (ECUs) for seamless interaction. The CAN protocol lacks built-in protection, leaving in-vehicle networks vulnerable to cyberattacks such as denial-of-service, message injection, replay, and suppression.To address these challenges, this study presents a deep learning–based intrusion detection approach that integrates a 1D Convolutional Neural Network (1D CNN) with a Bidirectional Long Short-Term Memory (BiLSTM) model, along with focal loss to improve detection performance. The 1D CNN is responsible for capturing spatial patterns from CAN frame attributes, including arbitration ID, data length code, and payload information. In contrast, the BiLSTM learns temporal dependencies by analyzing sequence patterns in both forward and backward directions. Furthermore, instead of relying on synthetic data balancing techniques such as SMOTE, focal loss is applied to give greater importance to difficult-to-detect attack samples during training, thereby effectively addressing the issue of class imbalance in CAN datasets. Additionally window labeling tactic that helps detect attacks more sensitively within a temporal window is also proposed. Besides these, the Car-Hacking dataset (driving scenario) with stratified 10-fold cross-validation is used to test the above framework. The experimental results demonstrate that the proposed approach can achieve an accuracy of 97.41%, precision of 96.37%, recall of 96.73%, F1-score of 96.49%, and ROC-AUC of 0.9971 which is way above the baseline BiLSTM model performance from the previous work. These findings confirm that a combination of spatial feature extraction, temporal sequence modeling, and imbalance-aware optimization not only ensures but also delivers a highly effective and more reliable intrusion detection solution for in-vehicle CAN network security.