Hyungchul Im

Uncomplicated application-level vehicular computing and networking (UAVCAN) is a higher-layer protocol built on the controller area network (CAN) bus to support control and status communication among electronic control units in unmanned aerial vehicles. Because CAN provides no native authentication or encryption, UAVCAN networks are vulnerable to message injection, replay, and flooding attacks. Most existing CAN intrusion detection systems, however, are designed for automotive networks and do not explicitly account for the transfer structure and tail-byte rules of UAVCAN. This paper proposes a protocol-aware intrusion detection framework that reconstructs UAVCAN transfers and extracts six payload features and four transfer features based on the CAN ID, transfer ID, toggle bit, and transfer-boundary information. The proposed feature set is evaluated using random forest, XGBoost, logistic regression, and multilayer perceptron classifiers on ten attack scenarios from a public UAVCAN dataset. The best-performing configuration achieves average accuracy, precision, and recall of 99.89%, 99.96%, and 99.88%, respectively. Ablation results show that transfer-rule features are particularly effective for replay-attack detection, while combining payload and transfer features provides the most consistent performance across attack types. The proposed approach also outperforms the evaluated automotive CAN IDS baselines and achieves competitive performance compared with existing UAVCAN-specific IDS methods. These findings support the value of protocol-aware feature extraction for UAVCAN intrusion detection.

The Controller Area Network (CAN) protocol used in in-vehicle networks is vulnerable to external attacks because it lacks authentication and encryption mechanisms. Accordingly, CAN Intrusion Detection Systems (IDSs) have been studied. However, existing IDSs remain difficult to deploy in practical vehicles because of their limited real-time capability, complex preprocessing, and high computational cost. To overcome these limitations, this paper proposes an ultra-lightweight Convolutional Neural Network (CNN)-based IDS that significantly reduces parameters and computational complexity while maintaining high detection performance. The proposed IDS improves area efficiency through a streaming pipeline, computation-block reuse, and constrained Processing Element (PE) parallelism. In addition, its lightweighting effect was quantitatively evaluated against an RTL baseline implemented under identical platform and design constraints. When an attack is detected, an Intrusion Prevention System (IPS) integrated with the CAN controller generates an error frame to block it in real time. The proposed IDS achieved over 99.97% detection performance for known frame-level message-injection scenarios on the Car-Hacking Dataset. It also achieved branch-wise real-time feasibility with an 11.46 µs ID-branch precomputation latency and a 5.68 µs DATA-complete-to-decision latency at 50 MHz. In TSMC 28 nm ASIC synthesis, the proposed IDS required 70,592 gates, with an estimated ASIC power of 2.0231 mW and an active inference energy of 34.68 nJ.

A controller area network (CAN) is the most widely used protocol to communicate between electronic control units (ECUs) inside a vehicle. however, it lacks basic security functions and a structure vulnerable to external attacks. Therefore, it is important to develop an intrusion detection system (IDS) that can effectively identify malicious and legitimate CAN messages, as well as an intrusion prevention system (IPS) that can block such malicious messages in real time. In this study, a random-forest-based intrusion detection system (RF-IDS) was proposed and integrated with a CAN controller to design a system that can perform real-time detection and attack blocking. Existing IDS studies aim for high detection performance. however, the real-time blocking function is limited or the possibility of hardware implementation is yet to be sufficiently verified. To address this issue, we designed an IDS that can immediately determine if an attack is present when receiving a CAN frame and blocking the attack node. Fast and efficient detection is possible complex matrix operations because the random forest model performs detection based on comparison operations. This confirmed that the corresponding structure achieved an average detection time of 1.86 μs and detection accuracy of more than 99%, allowing real-time intrusion blocking. Finally, hardware implementation was achieved by completing the design of the ASIC chip through a multiproject wafer process.

The controller area network (CAN) protocol, widely used for in-vehicle communication, lacks built-in security features and is inherently vulnerable to various attacks. Numerous attack techniques against CAN have been reported, leading to intrusion detection systems (IDSs) tailored for in-vehicle networks. In this study, we propose a novel lightweight unsupervised IDS for CAN networks, designed for real-time, on-device implementation. The proposed autoencoder model was trained exclusively on normal data. A portion of the attack data was utilized to determine the optimal detection threshold using a Gaussian kernel density estimation function, while the frame count was selected based on error rate analysis. Subsequently, the model was evaluated using four types of attack data that were not seen during training. Notably, the model employs a single threshold across all attack types, enabling detection using a single model. Furthermore, the designed software model was optimized for hardware implementation and validated on an FPGA under a real-time CAN communication environment. When evaluated, the proposed system achieved an average accuracy of 99.2%, precision of 99.2%, recall of 99.1%, and F1-score of 99.2%. Furthermore, compared to existing FPGA-based IDS models, our model reduced the usage of LUTs, flip-flops, and power by average factors of 1/5, 1/6, and 1/11.

This paper presents an Application-Specific Integrated Circuit (ASIC) implementation and Field-Programmable Gate Array (FPGA) verification of a Convolutional Neural Network (CNN)-based Intrusion Detection System (IDS) designed to enhance the security of an in-vehicle Controller Area Network (CAN) BUS and detect malicious messages. The CNN model employs a lightweight architecture with a single convolution layer using a 2 × 2 kernel and integrates a filter algorithm optimized for Fuzzy and Spoofing attacks to improve the performance. The IDS is implemented on an Electronic Control Unit platform powered by an ARM Cortex-M3 core and uses SRAM to store the parameters utilized by the CNN model and filter algorithm, targeting ASIC implementation with TSMC 180 nm technology. Functional verification was conducted by configuring a simplified CAN bus environment using the Xilinx Nexys Video FPGA and PEAK-System PCAN-USB, which was validated in real-time against DoS, Spoofing, and Fuzzy attack scenarios. The proposed lightweight CNN-based IDS achieved a fast detection speed of 0.0233 ms and an average accuracy of 99.6879%, thereby demonstrating its potential to enhance the security of in-vehicle CAN BUS.

This letter proposes a novel model for effectively detecting malicious messages in controller area network (CAN) communication, which is widely used in automotive networks. Because in-vehicle networks operate in resource-constrained environments, an intrusion detection system (IDS) must simultaneously provide a low computational load and excellent detection performance. However, existing models are unsuitable for deployment on low-power embedded devices owing to their high computational requirements. This letter presents a low-complexity convolutional neural network (CNN)-based IDS for deployment on embedded edge devices. The proposed model applies CNN operations separately to the CAN ID sequence and the data field of the CAN frame to extract features and concatenate them for feature fusion. Experimental results demonstrate that this approach requires considerably less computational load and provides superior detection performance. Furthermore, the proposed model is deployed on a resource-constrained nRF52840 microcontroller using TensorFlow Lite for Microcontrollers with 20.44 KB flash memory and 26.44 KB RAM without quantization.

The Controller Area Network (CAN), widely used for vehicular communication, is vulnerable to multiple types of cyber-threats. Attackers can inject malicious messages into the CAN bus through various channels, including wireless methods, entertainment systems, and on-board diagnostic ports. Therefore, it is crucial to develop a reliable intrusion detection system (IDS) capable of effectively distinguishing between legitimate and malicious CAN messages. In this paper, we propose a novel IDS architecture aimed at enhancing the cybersecurity of CAN bus systems in vehicles. Various machine learning (ML) models have been widely used to address similar problems; however, although existing ML-based IDS are computationally efficient, they suffer from suboptimal detection performance. To mitigate this shortcoming, our architecture incorporates specially designed rule-based filters that cross-check outputs from the traditional ML-based IDS. These filters scrutinize message ID and payload data to precisely capture the unique characteristics of three distinct types of cyberattacks: DoS attacks, spoofing attacks, and fuzzy attacks. Experimental evidence demonstrates that the proposed architecture leads to a significant improvement in detection performance across all utilized ML models. Specifically, all ML-based IDS achieved an accuracy exceeding 99% for every type of attack. This achievement highlights the robustness and effectiveness of our proposed solution in detecting potential threats.