A Multi-Standard (CAN/CAN-FD) logic extraction framework validated herein on legacy CAN and CAN Flexible Data-rate that reconciles high-precision detection with the deterministic requirements of embedded systems and satisfies the interpretability mandates of functional safety standards is proposed.
Abstract
The transition toward Software-Defined Vehicles has rendered internal networks, particularly the Controller Area Network, vulnerable to sophisticated cyberattacks. Although recent research has prioritized Deep Learning Intrusion Detection Systems for their statistical accuracy, these black-box models often fail to meet the strict latency and explainability constraints of automotive safety standards. This article proposes a Multi-Standard (CAN/CAN-FD) logic extraction framework validated herein on legacy CAN and CAN Flexible Data-rate, that reconciles high-precision detection with the deterministic requirements of embedded systems. By employing an elastic parsing mechanism and a constrained Classification and Regression Tree algorithm, the methodology distills complex attack signatures into compact, interpretable boolean rules. Unlike computationally intensive neural networks, this white-box approach ensures deterministic, bounded, worst-case execution time by design. Experimental validation using diverse datasets, including legacy and high-bandwidth CAN Flexible Data-rate traffic, demonstrates that the extracted boolean logic achieves a deterministic algorithmic inference latency as low as 0.15 microseconds. When benchmarked in an identical hardware environment, this represents a 14× empirical speedup over optimized internal ML baselines (XGBoost), and theoretically eliminates the heavy matrix multiplication overhead typical of state-of-the-art deep learning approaches, while maintaining average detection accuracy above 99.97 percent for the CAN Flexible Data-rate. Furthermore, the generated logic satisfies the interpretability mandates of functional safety standards.
Per-ID behavioral residualization is presented, a CAN-specific representation that extracts fourteen temporal, protocol, and payload features from sliding windows and residualizes them against each arbitration ID's normal baseline, which improves mean F1 in the majority of evaluations.
Software-Defined Networking (SDN) provides fine-grained control over network architectures, yet integrating intrusion detection systems (IDSs) into the control plane frequently introduces prohibitive computational overhead. This issue is compounded by the fact that existing machine learning models, typically trained on static benchmark datasets, often degrade under real-time polling conditions and unpredictable traffic bursts. To bridge this gap, this paper evaluates an ultra-compact five-feature polling scheme (F1–F5) designed to preserve statistical symmetry between control-plane monitoring and telemetry overhead within a dynamic Mininet–Ryu testbed. The experimental framework incorporates 15% background noise, and a 10% stealth attack overlaps across a 120 s dynamic trace. Four distinct classifiers—Random Forest (RF), Decision Tree (DT), Multi-Layer Perceptron (MLP), and Long Short-Term Memory (LSTM)—were evaluated across frame-by-frame snapshot and windowed prediction tasks. Empirical findings reveal that tree-based ensembles consistently outperform deep learning approaches, with RF attaining an overall accuracy of 97.57% and DT achieving 96.74%, compared to 90.77% for MLP and 90.73% for LSTM. Analysis of the time-series logs demonstrates that RF’s orthogonal decision boundaries successfully isolate transient, high-intensity threats such as WebAttack and PortScan vectors without needing memory-intensive recurrent architectures. Ultimately, pairing minimal feature extraction with lightweight tree ensembles offers an optimal balance between low control-plane latency and high detection efficacy.
Controller Area Network (CAN) is the dominant in-vehicle bus, yet its broadcast design and absent authentication leave it exposed to injection and spoofing attacks. Existing deep-learning intrusion detection systems achieve strong accuracy but depend on ML inference frameworks incompatible with the resource budgets of production Electronic Control Units (ECUs). We present a systems-oriented pipeline that trains four neural architectures—Transformer, CNN, LSTM, and ANN—on a five-class labeled CAN dataset and distills each into a framework-free C++ decision tree via the Trustee protocol. We observe and address a systematic false-alarm collapse on Normal-class traffic: standard Trustee produces around 30% FPR-N because Normal frames constitute only 5.4% of training data. A class-balanced Trustee variant, which oversamples Normal by factor α=5, reduces FPR-N to 13.8±1.4% (three Trustee runs) while preserving 91.1±0.6% accuracy and 0.918±0.006 macro-F1 at 2.1% CPU on a Raspberry Pi 4, versus 22.6% for TF-Lite int8 and 59.4% for TensorFlow on the same board. We additionally report α and depth ablations, three-seed teacher statistics, and per-class recall for all models.Code: https://github.com/Amirmasoud-Pourmiri/Lightweight-Neural-Network-Distillation-for-Real-Time-CAN-Bus-Intrusion-Detection-in-Vehicles
Amirmasoud Pourmiri, Ali Eslami, Sergio A. Salinas Monroy· International Conference on...· 0 citations
Operational technology (OT) environments, including programmable logic controllers (PLCs), industrial control systems (ICS), and supervisory control and data acquisition (SCADA) systems, are increasingly targeted by distributed denial-of-service (DDoS) attacks. This paper presents a neuro-symbolic framework specifically designed for robust DDoS detection in these resource-constrained environments. The framework fuses a gated recurrent unit (GRU) neural network with a shallow decision tree as a symbolic component. The symbolic component alone provides a compact, interpretable rule set, while the fusion combines the strengths of both paradigms. The hybrid model is evaluated on three real-world benchmark DDoS datasets: CIC-DDoS2019, Edge-IIoTset, and CICIoT23. A unified comprehensive preprocessing pipeline including label mapping, numerical feature selection, robust scaling, and class balancing is applied. The fusion weight alpha and decision threshold are jointly optimised on validation data to maximise F1-score. The hybrid model attains 99.04% accuracy (MCC 0.97) on CIC-DDoS2019 and 98.61% accuracy (MCC 0.76) on CICIoT23, in both cases reducing the FNR below that of the pure-neural and pure-symbolic baselines; on the linearly separable Edge-IIoTset the shallow decision tree alone already reaches 100%, so this benchmark validates the preprocessing pipeline rather than the fusion. The principal gain of the fusion is a lower FNR at a controlled false-positive cost, which matters in operational technology, where a missed attack is more damaging than a false alarm. Model-only inference latency is sub-millisecond (0.58-0.79 milliseconds per sample) on a standard central processing unit; including on-device flow-feature extraction, the end-to-end path remains within a single-digit-millisecond budget, which is compatible with OT control-loop timing.
Mikiyas Alemayehu, Mohamed Chahine Ghanem, H. Kheddar et al.· 0 citations
A sniffer-free detection pipeline that operates exclusively on the integer counters each mote already maintains for normal operation of RPL, indicating that detection in constrained IoT networks is bounded by what the mote reports, not by classifier sophistication.
E. Pacheco, C. Pedroso· IEEE Open Journal of the Com...· 0 citations
Autonomous response has evolved into a timing-critical challenge rather than solely a matter of detection accuracy. In recent intrusions, the interval between initial access and the first lateral movement has been observed to be as short as 27 seconds, a window that precludes any human-in-the-loop workflow. This paper presents a closed-loop framework that detects and blocks attacks in software-defined networks without operator involvement, evaluating its performance against this stringent temporal constraint rather than relying exclusively on detection accuracy. An automated data pipeline collects IP flows and aggregates them into labeled training data, while a prevention module selects and trains candidate classifiers and issues blocking rules directly to the SDN controller. In a SYN flooding denial of service case study, the deployed K-Nearest Neighbors classifier achieved an F1 score of 96.7% and the cycle from flow availability to enforced block completed in 21 seconds, below the fastest breakout time reported to date.
