Jul 2026· Journal of the Brazilian Computer Society· Vol 32, pp. 1755-1785· 0 citations· 122 references
Computer Science
TL;DR
A key contribution of this survey is the introduction of explicit and consistent criteria for labeling IDSs as lightweight, real-time, or deployable, based only on substantiated evidence such as ECU-oriented runtime analysis, embedded evaluation, or real-vehicle experimentation.
Abstract
The Controller Area Network (CAN) bus continues to serve as the core communication backbone of modern vehicles. However, its original design did not incorporate fundamental security mechanisms, leaving in-vehicle networks vulnerable to cyberattacks such as spoofing, replay, message injection, and denial-of-service. As a result, Intrusion Detection Systems (IDSs) have become an essential component of automotive cybersecurity, providing continuous monitoring of CAN traffic to identify malicious behavior. In recent years, researchers have increasingly turned to intelligent IDS solutions based on Machine Learning (ML), Deep Learning (DL), and hybrid learning approaches to enhance detection capability. Although many of these studies report impressive detection accuracy, their evaluation practices often vary significantly, and claims related to real-time performance or lightweight deployment are frequently made without sufficient practical validation. This survey provides a structured, deployment-focused review of learning-based IDSs for CAN bus security published between 2019 and 2025. Building on prior surveys that emphasize detection accuracy and high-level method categorization, this work evaluates IDS approaches from a practical perspective by considering detection performance alongside computational efficiency, real-time feasibility, and deployment readiness in resource-constrained automotive environments. ML-based, DL-based, and hybrid IDS approaches are organized within a unified taxonomy and systematically compared across model architectures, attack scenarios, datasets, real-time feasibility, lightweight design claims, and validation strategies. A key contribution of this survey is the introduction of explicit and consistent criteria for labeling IDSs as lightweight, real-time, or deployable, based only on substantiated evidence such as ECU-oriented runtime analysis, embedded evaluation, or real-vehicle experimentation. Through a set of unified comparative tables, the survey highlights common evaluation gaps, and mismatches between reported performance and practical feasibility.
In the era of contemporary data traffic routing, the concept of Intrusion Detection Systems (IDS) is substantially utilized. However, the efficacy of IDS is often decreased because of the reality that high-concentration traffic postfixes, sophisticated cyber criminals, and more and more stringent demands are tending to decrease in resource-limited environments. The paper presents the enhanced intrusion detection system based on deep learning architecture, which can be flexible, adaptive and as well maintain the high detection capability with confidence under changing or to-be changed network settings. The objectives of this and aforementioned also address the issue of avoiding strong overtting behavior by models during the transfer learning and even rich feature representation through the first-stage operation: moving to address and ideally preventing attacks rather than supporting other attacks. The work is tailored to the deployment of the light-weight and adaptive IDS design which is supposed to be large enough to work in real time on low-powered devices such as IoTs and edge devices that are nondominated in energy and computationally less demanding. Real-time adaptability of the model will be examined through operational deployment simulations. It is also expected that such simulations would take into account latency, throughput, and energy consumption of the IDS model. On the one hand, In a stage nested within the very last period of this research, the IDS model has been merged with Explainable AI technologies; now LIME and SHAP are also preserved to improve the interpretability of the model decisions and the level of decision-making. What kind of feature attributions are made with the intrusion data? How is Interpretability of the model evaluated in terms of fidelity, comprehensibility, and expert belief? Therefore, all the above-mentioned events will be a perfect example of how the technologically ingrained tasks, particularly in the technical discipline of security studies, can be wrapped into the very cognitive resource of human beings.
Krishna Kumar Tiwari· 2026 International Conferenc...· 0 citations
A hybrid deep-learning intrusion detection system (IDS) that combines one-dimensional convolutional layers, a bidirectional long short-term memory (BiLSTM) network, and a temporal attention mechanism to detect malicious activity directly from CAN frame streams is presented.
Ginne M James· International Journal of Inf...· 0 citations
Critical safety functions in modern vehicles rely heavily on intra-vehicle networks (IVNs), primarily via the Controller Area Network (CAN) protocol. The inherent vulnerabilities of CAN require robust intrusion detection systems (IDS) to mitigate adversarial threats. However, state-of-the-art IDS, especially AI-based approaches, often lack a comprehensive, well-defined performance analysis method. This work proposes and evaluates a structured pipeline for in-vehicle IDS, analyzing an autoencoder semi-supervised IDS as a practical case study. The method is validated on publicly available datasets, covering multiple attack types, with additional analysis of generalization capabilities. Performance is rigorously assessed using precision, recall, F1-score, and the Matthews Correlation Coefficient (MCC), chosen for its robustness in imbalanced scenarios. Results demonstrated highly efficient identification of DoS attacks (MCC 1.00), though Fuzzy DoS detection showed lower performance (MCC 0.214 in CAN-MIRGU and 0.074 in CAN-MODES). These findings support the viability of the proposed pipeline for IDS analysis focusing on enhancing CAN network security, consistent with recent research trends.
Lucas Melo da Silva Alves, Alexandre dos Santos Roque, E. P. de Freitas· International Conference on...· 0 citations
The work is devoted to a comprehensive systematic review of advances in identifying the state of computer systems and networks in the context of cybersecurity for the period 2022–2026. The study analyzes the evolution of intrusion detection systems (IDS), provides categorization and synthesis of key approaches, including supervised, unsupervised, and semi-supervised learning, as well as statistical and temporal analysis methods. Particular attention is paid to deep learning models (CNN, RNN/LSTM, Transformers, GNN) and their hybrid combinations, which demonstrate accuracy above 95% in detecting complex multi-stage attacks and zero-day threats. The experience of implementing identification methods in specific domains such as IoT, SCADA, automotive networks, and maritime transportation systems is summarized. Critical challenges for the scientific community are identified, including the problem of explainable artificial intelligence (XAI), resilience to adversarial attacks, and optimization for real-time operation on resource-constrained devices. Conclusions. The study revealed a trend of transition from classical static signature-based methods to dynamic intelligent algorithms. The analysis of available sources made it possible to classify the considered approaches according to their mathematical foundations and operational characteristics. For each group of methods, their main advantages, disadvantages, and key prospects for application were identified. It was found that hybrid and ensemble models provide the highest accuracy in complex environments (over 99%), while the combination of convolutional neural networks with recurrent networks or Transformers is the most effective solution for detecting multi-stage attacks. In addition, the growing role of federated learning in the development and implementation of intrusion detection systems was emphasized.
V. Chelak, Oleksii Hornostal, Yehor Chelak et al.· Advanced Information Systems· 0 citations
Modern vehicles rely heavily on in-vehicle Controller Area Network (CAN) communication to coordinate safety-critical electronic control units (ECUs). However, the CAN protocol was not originally designed with authentication, encryption, or message integrity mechanisms, making it vulnerable to injection, spoofing, fuzzy, and denial-of-service attacks. Although machine learning-based intrusion detection systems have achieved high detection accuracy on CAN traffic, detection alone is not sufficient for safety-critical automotive environments where malicious messages may affect ECUs before a response is triggered. This paper presents a progressive machine learning-based framework for prevention-oriented CAN bus security. The framework analyzes statistical and temporal CAN traffic features and evaluates multiple machine learning models under three scenarios: binary attack detection, attack-type classification, and prevention-oriented allow/block decision evaluation. The study uses the Car-Hacking dataset and compares several supervised and anomaly-detection models, including tree-based ensembles, linear models, probabilistic models, neural models, and anomaly detectors. The results show that tree-based models achieve the strongest overall performance, with Random Forest reaching 99.6% accuracy in binary detection. The proposed prevention layer is evaluated as a software-level decision mechanism that converts model outputs into allow/block decisions, while CAN-aware blocking mechanisms are discussed only as architectural deployment options for future inline gateway implementation. The findings indicate that lightweight tree-based machine learning models can support real-time prevention-oriented decisions in CAN security, while further validation on hardware testbeds, realistic CAN bus-load conditions, and cross-dataset settings remains necessary.
Younis A. M. Al Shojaa, Redhwan M. A. Saad, Khaled A. M. Al Soufy· 2026 6th International Confe...· 0 citations
This paper presents a comprehensive and systematic review of deep learning techniques applied to cyber intrusion detection within IoV systems, conducted in accordance with the PRISMA framework across 83 selected studies published between 2020 and 2025.
Duygu Kayaoğlu, Eyup Emre Ulku, Onder Demir· Journal of Supercomputing· 0 citations